Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1764002AbYBLSJZ (ORCPT ); Tue, 12 Feb 2008 13:09:25 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1763282AbYBLSJL (ORCPT ); Tue, 12 Feb 2008 13:09:11 -0500 Received: from e3.ny.us.ibm.com ([32.97.182.143]:59018 "EHLO e3.ny.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1763160AbYBLSJI (ORCPT ); Tue, 12 Feb 2008 13:09:08 -0500 Date: Tue, 12 Feb 2008 12:08:59 -0600 From: "Serge E. Hallyn" To: Kohei KaiGai Cc: "Serge E. Hallyn" , "Andrew G. Morgan" , akpm@osdl.org, jmorris@namei.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: Re: [PATCH] exporting capability code/name pairs (try #4) Message-ID: <20080212180859.GA12876@sergelap.austin.ibm.com> References: <47997122.3070504@ak.jp.nec.com> <479990A1.3050103@kernel.org> <4799CAE0.7010400@ak.jp.nec.com> <47A2AB60.5000403@ak.jp.nec.com> <20080204162103.GA20130@sergelap.ibm.com> <47A91B00.9080301@ak.jp.nec.com> <20080206050805.GD3258@sergelap.austin.ibm.com> <47AC23F1.5030300@ak.jp.nec.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <47AC23F1.5030300@ak.jp.nec.com> User-Agent: Mutt/1.5.16 (2007-06-09) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 7395 Lines: 202 Quoting Kohei KaiGai (kaigai@ak.jp.nec.com): > This patch enables to export code/name pair of capabilities supported > on the running kernel, under the /sys/kernel/capability . > We can apply it onto the latest Linus's git tree. > > Changes from the previous version: > - I added "names/" ans "codes/" directories, and we can use them > to lookup capability code or name non-sequentially. > In the previous version, we had to scan whole of entries to lookup > capability name by its code. > (required by Andrew Morgan) > - I added an assertion when "mkcapname.sh" works incorrectly. > (required by Serge E.Hallyn) > > In addition, Andrew suggested me to export these translation by symlinks > to reduce the number of invocation of system call. > However, current sysfs interface does not allows to create symlinks with > invalid indication. > Thus, this patch exports them as regular files. > > -------------------------------------------------------- > [kaigai@saba ~]$ ls -R /sys/kernel/capability/ > /sys/kernel/capability/: > codes names version > > /sys/kernel/capability/codes: > 0 10 12 14 16 18 2 21 23 25 27 29 30 32 4 6 8 > 1 11 13 15 17 19 20 22 24 26 28 3 31 33 5 7 9 > > /sys/kernel/capability/names: > cap_audit_control cap_kill cap_net_raw cap_sys_nice > cap_audit_write cap_lease cap_setfcap cap_sys_pacct > cap_chown cap_linux_immutable cap_setgid cap_sys_ptrace > cap_dac_override cap_mac_admin cap_setpcap cap_sys_rawio > cap_dac_read_search cap_mac_override cap_setuid cap_sys_resource > cap_fowner cap_mknod cap_sys_admin cap_sys_time > cap_fsetid cap_net_admin cap_sys_boot cap_sys_tty_config > cap_ipc_lock cap_net_bind_service cap_sys_chroot > cap_ipc_owner cap_net_broadcast cap_sys_module > [kaigai@saba ~]$ cat /sys/kernel/capability/codes/20 > cap_sys_pacct > [kaigai@saba ~]$ cat /sys/kernel/capability/names/cap_mknod > 27 > [kaigai@saba ~]$ > -------------------------------------------------------- > Any comment please. > > Thanks, > > Signed-off-by: KaiGai Kohei > ---- > scripts/mkcapnames.sh | 44 +++++++++++++++++++ > security/Kconfig | 9 ++++ > security/Makefile | 11 +++++ > security/capability.c | 115 +++++++++++++++++++++++++++++++++++++++++++++++++ > 4 files changed, 179 insertions(+), 0 deletions(-) > > diff --git a/scripts/mkcapnames.sh b/scripts/mkcapnames.sh > index e69de29..9e7290f 100644 > --- a/scripts/mkcapnames.sh > +++ b/scripts/mkcapnames.sh > @@ -0,0 +1,44 @@ > +#!/bin/sh > + > +# > +# generate a cap_names.h file from include/linux/capability.h > +# > + > +CAPHEAD="`dirname $0`/../include/linux/capability.h" > +REGEXP='^#define CAP_[A-Z_]+[ ]+[0-9]+$' > +NUMCAP=`cat "$CAPHEAD" | egrep -c "$REGEXP"` > + > +echo '#ifndef CAP_NAMES_H' > +echo '#define CAP_NAMES_H' > +echo > +echo '/*' > +echo ' * Do NOT edit this file directly.' > +echo ' * This file is generated from include/linux/capability.h automatically' > +echo ' */' > +echo > +echo '#if !defined(SYSFS_CAP_NAME_ENTRY) || !defined(SYSFS_CAP_CODE_ENTRY)' > +echo '#error cap_names.h should be included from security/capability.c' > +echo '#else' > +echo "#if $NUMCAP != CAP_LAST_CAP + 1" > +echo '#error mkcapnames.sh cannot collect capabilities correctly' > +echo '#else' > +cat "$CAPHEAD" | egrep "$REGEXP" \ > + | awk '{ printf("SYSFS_CAP_NAME_ENTRY(%s,%s);\n", tolower($2), $2); }' > +echo > +echo 'static struct attribute *capability_name_attrs[] = {' > +cat "$CAPHEAD" | egrep "$REGEXP" \ > + | awk '{ printf("\t&%s_name_attr.attr,\n", tolower($2)); } END { print "\tNULL," }' > +echo '};' > + > +echo > +cat "$CAPHEAD" | egrep "$REGEXP" \ > + | awk '{ printf("SYSFS_CAP_CODE_ENTRY(%s,%s);\n", tolower($2), $2); }' > +echo > +echo 'static struct attribute *capability_code_attrs[] = {' > +cat "$CAPHEAD" | egrep "$REGEXP" \ > + | awk '{ printf("\t&%s_code_attr.attr,\n", tolower($2)); } END { print "\tNULL," }' > +echo '};' > + > +echo '#endif' > +echo '#endif' > +echo '#endif' > diff --git a/security/Kconfig b/security/Kconfig > index 25ffe1b..b79e830 100644 > --- a/security/Kconfig > +++ b/security/Kconfig > @@ -91,6 +91,15 @@ config SECURITY_FILE_CAPABILITIES > > If in doubt, answer N. > > +config SECURITY_CAPABILITIES_EXPORT > + bool "Exporting capabilities kernel supported" > + depends on SECURITY_CAPABILITIES && SYSFS Oh no, we're being bit by this again... When SECURITY=n, capabilities are compiled in but SECURITY_CAPABILITIES=n. Months ago I floated the following patch so we'd have a CONFIG variable to let us know whether commoncap is compiled in. You might want to use this and depend on CONFIG_COMMONCAP? (Though really I personally don't think you need your own config variable for this) Other than that, this tested fine for me. thanks, -serge >From 54c70ca7671750fe8986451fae91d42107d0ca90 Mon Sep 17 00:00:00 2001 From: Serge E. Hallyn Date: Fri, 28 Sep 2007 10:33:33 -0500 Subject: [PATCH 1/2] capabilities: define CONFIG_COMMONCAP currently the compilation of commoncap.c is determined through Makefile logic. So there is no single CONFIG variable which can be relied upon to know whether it will be compiled. Define CONFIG_COMMONCAP to be true when lsm is not compiled in, or when the capability or rootplug modules are compiled. These are the cases when commoncap is currently compiled. Use this variable in security/Makefile to determine commoncap.c's compilation. Apart from being a logic cleanup, this is needed by the upcoming cap_bset patch so that prctl can know whether PR_SET_BSET should be allowed. Signed-off-by: Serge E. Hallyn --- security/Kconfig | 4 ++++ security/Makefile | 9 +++------ 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/security/Kconfig b/security/Kconfig index 8086e61..02b33fa 100644 --- a/security/Kconfig +++ b/security/Kconfig @@ -103,6 +103,10 @@ config SECURITY_ROOTPLUG If you are unsure how to answer this question, answer N. +config COMMONCAP + bool + default !SECURITY || SECURITY_CAPABILITIES || SECURITY_ROOTPLUG + source security/selinux/Kconfig endmenu diff --git a/security/Makefile b/security/Makefile index ef87df2..7cccc81 100644 --- a/security/Makefile +++ b/security/Makefile @@ -5,14 +5,11 @@ obj-$(CONFIG_KEYS) += keys/ subdir-$(CONFIG_SECURITY_SELINUX) += selinux -# if we don't select a security model, use the default capabilities -ifneq ($(CONFIG_SECURITY),y) -obj-y += commoncap.o -endif +obj-$(CONFIG_COMMONCAP) += commoncap.o # Object file lists obj-$(CONFIG_SECURITY) += security.o dummy.o inode.o # Must precede capability.o in order to stack properly. obj-$(CONFIG_SECURITY_SELINUX) += selinux/built-in.o -obj-$(CONFIG_SECURITY_CAPABILITIES) += commoncap.o capability.o -obj-$(CONFIG_SECURITY_ROOTPLUG) += commoncap.o root_plug.o +obj-$(CONFIG_SECURITY_CAPABILITIES) += capability.o +obj-$(CONFIG_SECURITY_ROOTPLUG) += root_plug.o -- 1.5.1.1.GIT -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/