Messages in this thread Patch in this message |  | | | Date | Tue, 11 May 2004 16:56:39 -0700 | | From | Chris Wright <> | | Subject | [PATCH 3/3] add disable param to capabilities module |
| |
Add disable param to capabilities module. Similar to the SELinux param for disabling at boot time. This allows vendors to ship single binary image with capabilities compiled statically, and disable it if they provide another security model compiled as module.
--- linus-2.5/security/capability.c~disable 2004-05-11 16:14:36.121676768 -0700 +++ linus-2.5/security/capability.c 2004-05-11 16:19:25.906622760 -0700 @@ -22,6 +22,7 @@ #include <linux/skbuff.h> #include <linux/netlink.h> #include <linux/ptrace.h> +#include <linux/moduleparam.h> static struct security_operations capability_ops = { .ptrace = cap_ptrace, @@ -52,9 +53,16 @@ /* flag to keep track of how we were registered */ static int secondary; +static int capability_disable; +module_param_named(disable, capability_disable, int, 0); +MODULE_PARM_DESC(disable, "To disable capabilities module set disable = 1"); static int __init capability_init (void) { + if (capability_disable) { + printk(KERN_INFO "Capabilities disabled at initialization\n"); + return 0; + } /* register ourselves with the security framework */ if (register_security (&capability_ops)) { /* try registering with primary module */ @@ -72,6 +80,8 @@ static void __exit capability_exit (void) { + if (capability_disable) + return; /* remove ourselves from the security framework */ if (secondary) { if (mod_unreg_security (MY_NAME, &capability_ops)) - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
|  |