lkml.org 
[lkml]   [2008]   [Apr]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: [PATCH 0/3] exporting capability name/code pairs (for 2.6.26)
    On Tue, Apr 22, 2008 at 08:12:15PM +0900, KaiGai Kohei wrote:
    > $ ls -R /sys/kernel/capability/
    > /sys/kernel/capability/:
    > codes names version
    >
    > /sys/kernel/capability/codes:
    > 0 10 12 14 16 18 2 21 23 25 27 29 30 32 4 6 8
    > 1 11 13 15 17 19 20 22 24 26 28 3 31 33 5 7 9
    >
    > /sys/kernel/capability/names:
    > cap_audit_control cap_kill cap_net_raw cap_sys_nice
    > cap_audit_write cap_lease cap_setfcap cap_sys_pacct
    > cap_chown cap_linux_immutable cap_setgid cap_sys_ptrace
    > cap_dac_override cap_mac_admin cap_setpcap cap_sys_rawio
    > cap_dac_read_search cap_mac_override cap_setuid cap_sys_resource
    > cap_fowner cap_mknod cap_sys_admin cap_sys_time
    > cap_fsetid cap_net_admin cap_sys_boot cap_sys_tty_config
    > cap_ipc_lock cap_net_bind_service cap_sys_chroot
    > cap_ipc_owner cap_net_broadcast cap_sys_module
    > $ cat /sys/kernel/capability/names/cap_sys_pacct
    > 20
    > $ cat /sys/kernel/capability/codes/16
    > cap_sys_module

    This is amazing amount of bloat for such conceptually simple feature!

    Below is /proc/capabilities ,
    a) without all memory eaten by sysfs files and directories,
    generated on the fly
    b) with capability names matching the ones in manpages
    c) nicely formatted
    e) with whole-whooping 2 lines of protection from fool
    (including helpful directions)
    Proposed regexp of course will incorrectly match someday

    If this file will be used often, I can even make whole its content
    become generated at compile time and then put into buffers
    with 1 (one) seq_puts()!

    Alexey "0 CAP_CHOWN
    1 CAP_DAC_OVERRIDE
    2 CAP_DAC_READ_SEARCH
    3 CAP_FOWNER
    4 CAP_FSETID
    5 CAP_KILL
    6 CAP_SETGID
    7 CAP_SETUID
    8 CAP_SETPCAP
    9 CAP_LINUX_IMMUTABLE
    10 CAP_NET_BIND_SERVICE
    11 CAP_NET_BROADCAST
    12 CAP_NET_ADMIN
    13 CAP_NET_RAW
    14 CAP_IPC_LOCK
    15 CAP_IPC_OWNER
    16 CAP_SYS_MODULE
    17 CAP_SYS_RAWIO
    18 CAP_SYS_CHROOT
    19 CAP_SYS_PTRACE
    20 CAP_SYS_PACCT
    21 CAP_SYS_ADMIN
    22 CAP_SYS_BOOT
    23 CAP_SYS_NICE
    24 CAP_SYS_RESOURCE
    25 CAP_SYS_TIME
    26 CAP_SYS_TTY_CONFIG
    27 CAP_MKNOD
    28 CAP_LEASE
    29 CAP_AUDIT_WRITE
    30 CAP_AUDIT_CONTROL
    31 CAP_SETFCAP
    32 CAP_MAC_OVERRIDE
    33 CAP_MAC_ADMIN" Dobriyan

    --- a/security/commoncap.c
    +++ b/security/commoncap.c
    @@ -19,6 +19,8 @@
    #include <linux/swap.h>
    #include <linux/skbuff.h>
    #include <linux/netlink.h>
    +#include <linux/proc_fs.h>
    +#include <linux/seq_file.h>
    #include <linux/ptrace.h>
    #include <linux/xattr.h>
    #include <linux/hugetlb.h>
    @@ -597,3 +599,81 @@ int cap_vm_enough_memory(struct mm_struct *mm, long pages)
    return __vm_enough_memory(mm, pages, cap_sys_admin);
    }

    +#ifdef CONFIG_PROC_FS
    +static const struct {
    + int val;
    + const char *str;
    +} proc_cap[] = {
    +#define _(cap) { .val = cap, .str = #cap }
    + _(CAP_CHOWN),
    + _(CAP_DAC_OVERRIDE),
    + _(CAP_DAC_READ_SEARCH),
    + _(CAP_FOWNER),
    + _(CAP_FSETID),
    + _(CAP_KILL),
    + _(CAP_SETGID),
    + _(CAP_SETUID),
    + _(CAP_SETPCAP),
    + _(CAP_LINUX_IMMUTABLE),
    + _(CAP_NET_BIND_SERVICE),
    + _(CAP_NET_BROADCAST),
    + _(CAP_NET_ADMIN),
    + _(CAP_NET_RAW),
    + _(CAP_IPC_LOCK),
    + _(CAP_IPC_OWNER),
    + _(CAP_SYS_MODULE),
    + _(CAP_SYS_RAWIO),
    + _(CAP_SYS_CHROOT),
    + _(CAP_SYS_PTRACE),
    + _(CAP_SYS_PACCT),
    + _(CAP_SYS_ADMIN),
    + _(CAP_SYS_BOOT),
    + _(CAP_SYS_NICE),
    + _(CAP_SYS_RESOURCE),
    + _(CAP_SYS_TIME),
    + _(CAP_SYS_TTY_CONFIG),
    + _(CAP_MKNOD),
    + _(CAP_LEASE),
    + _(CAP_AUDIT_WRITE),
    + _(CAP_AUDIT_CONTROL),
    + _(CAP_SETFCAP),
    + _(CAP_MAC_OVERRIDE),
    + _(CAP_MAC_ADMIN),
    +#undef _
    +};
    +
    +static int proc_capabilities_show(struct seq_file *m, void *v)
    +{
    + int i;
    +
    + for (i = 0; i < ARRAY_SIZE(proc_cap); i++)
    + seq_printf(m, "%d\t%s\n", proc_cap[i].val, proc_cap[i].str);
    + return 0;
    +}
    +
    +static int proc_capabilities_open(struct inode *inode, struct file *file)
    +{
    + return single_open(file, proc_capabilities_show, NULL);
    +}
    +
    +static const struct file_operations capabilities_proc_fops = {
    + .owner = THIS_MODULE,
    + .open = proc_capabilities_open,
    + .read = seq_read,
    + .llseek = seq_lseek,
    + .release = single_release,
    +};
    +
    +static int __init commoncap_init(void)
    +{
    + struct proc_dir_entry *pde;
    +
    + pde = proc_create("capabilities", 0, NULL, &capabilities_proc_fops);
    + if (!pde)
    + return -ENOMEM;
    + /* Forgot to add new capability to proc_cap array? */
    + BUILD_BUG_ON(ARRAY_SIZE(proc_cap) != CAP_LAST_CAP + 1);
    + return 0;
    +}
    +module_init(commoncap_init);
    +#endif


    \
     
     \ /
      Last update: 2008-04-22 20:39    [W:4.576 / U:0.128 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site