Linux Kernel  3.7.1
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros Groups Pages
capability.h
Go to the documentation of this file.
1 /*
2  * This is <linux/capability.h>
3  *
4  * Andrew G. Morgan <[email protected]>
5  * Alexander Kjeldaas <[email protected]>
6  * with help from Aleph1, Roland Buresund and Andrew Main.
7  *
8  * See here for the libcap library ("POSIX draft" compliance):
9  *
10  * ftp://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.6/
11  */
12 #ifndef _LINUX_CAPABILITY_H
13 #define _LINUX_CAPABILITY_H
14 
15 #include <uapi/linux/capability.h>
16 
17 
18 #define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3
19 #define _KERNEL_CAPABILITY_U32S _LINUX_CAPABILITY_U32S_3
20 
21 extern int file_caps_enabled;
22 
23 typedef struct kernel_cap_struct {
25 } kernel_cap_t;
26 
27 /* exact same as vfs_cap_data but in cpu endian and always filled completely */
32 };
33 
34 #define _USER_CAP_HEADER_SIZE (sizeof(struct __user_cap_header_struct))
35 #define _KERNEL_CAP_T_SIZE (sizeof(kernel_cap_t))
36 
37 
38 struct inode;
39 struct dentry;
40 struct user_namespace;
41 
42 struct user_namespace *current_user_ns(void);
43 
44 extern const kernel_cap_t __cap_empty_set;
45 extern const kernel_cap_t __cap_init_eff_set;
46 
47 /*
48  * Internal kernel functions only
49  */
50 
51 #define CAP_FOR_EACH_U32(__capi) \
52  for (__capi = 0; __capi < _KERNEL_CAPABILITY_U32S; ++__capi)
53 
54 /*
55  * CAP_FS_MASK and CAP_NFSD_MASKS:
56  *
57  * The fs mask is all the privileges that fsuid==0 historically meant.
58  * At one time in the past, that included CAP_MKNOD and CAP_LINUX_IMMUTABLE.
59  *
60  * It has never meant setting security.* and trusted.* xattrs.
61  *
62  * We could also define fsmask as follows:
63  * 1. CAP_FS_MASK is the privilege to bypass all fs-related DAC permissions
64  * 2. The security.* and trusted.* xattrs are fs-related MAC permissions
65  */
66 
67 # define CAP_FS_MASK_B0 (CAP_TO_MASK(CAP_CHOWN) \
68  | CAP_TO_MASK(CAP_MKNOD) \
69  | CAP_TO_MASK(CAP_DAC_OVERRIDE) \
70  | CAP_TO_MASK(CAP_DAC_READ_SEARCH) \
71  | CAP_TO_MASK(CAP_FOWNER) \
72  | CAP_TO_MASK(CAP_FSETID))
73 
74 # define CAP_FS_MASK_B1 (CAP_TO_MASK(CAP_MAC_OVERRIDE))
75 
76 #if _KERNEL_CAPABILITY_U32S != 2
77 # error Fix up hand-coded capability macro initializers
78 #else /* HAND-CODED capability initializers */
79 
80 # define CAP_EMPTY_SET ((kernel_cap_t){{ 0, 0 }})
81 # define CAP_FULL_SET ((kernel_cap_t){{ ~0, ~0 }})
82 # define CAP_FS_SET ((kernel_cap_t){{ CAP_FS_MASK_B0 \
83  | CAP_TO_MASK(CAP_LINUX_IMMUTABLE), \
84  CAP_FS_MASK_B1 } })
85 # define CAP_NFSD_SET ((kernel_cap_t){{ CAP_FS_MASK_B0 \
86  | CAP_TO_MASK(CAP_SYS_RESOURCE), \
87  CAP_FS_MASK_B1 } })
88 
89 #endif /* _KERNEL_CAPABILITY_U32S != 2 */
90 
91 # define cap_clear(c) do { (c) = __cap_empty_set; } while (0)
92 
93 #define cap_raise(c, flag) ((c).cap[CAP_TO_INDEX(flag)] |= CAP_TO_MASK(flag))
94 #define cap_lower(c, flag) ((c).cap[CAP_TO_INDEX(flag)] &= ~CAP_TO_MASK(flag))
95 #define cap_raised(c, flag) ((c).cap[CAP_TO_INDEX(flag)] & CAP_TO_MASK(flag))
96 
97 #define CAP_BOP_ALL(c, a, b, OP) \
98 do { \
99  unsigned __capi; \
100  CAP_FOR_EACH_U32(__capi) { \
101  c.cap[__capi] = a.cap[__capi] OP b.cap[__capi]; \
102  } \
103 } while (0)
104 
105 #define CAP_UOP_ALL(c, a, OP) \
106 do { \
107  unsigned __capi; \
108  CAP_FOR_EACH_U32(__capi) { \
109  c.cap[__capi] = OP a.cap[__capi]; \
110  } \
111 } while (0)
112 
113 static inline kernel_cap_t cap_combine(const kernel_cap_t a,
114  const kernel_cap_t b)
115 {
117  CAP_BOP_ALL(dest, a, b, |);
118  return dest;
119 }
120 
121 static inline kernel_cap_t cap_intersect(const kernel_cap_t a,
122  const kernel_cap_t b)
123 {
125  CAP_BOP_ALL(dest, a, b, &);
126  return dest;
127 }
128 
129 static inline kernel_cap_t cap_drop(const kernel_cap_t a,
130  const kernel_cap_t drop)
131 {
133  CAP_BOP_ALL(dest, a, drop, &~);
134  return dest;
135 }
136 
137 static inline kernel_cap_t cap_invert(const kernel_cap_t c)
138 {
140  CAP_UOP_ALL(dest, c, ~);
141  return dest;
142 }
143 
144 static inline int cap_isclear(const kernel_cap_t a)
145 {
146  unsigned __capi;
147  CAP_FOR_EACH_U32(__capi) {
148  if (a.cap[__capi] != 0)
149  return 0;
150  }
151  return 1;
152 }
153 
154 /*
155  * Check if "a" is a subset of "set".
156  * return 1 if ALL of the capabilities in "a" are also in "set"
157  * cap_issubset(0101, 1111) will return 1
158  * return 0 if ANY of the capabilities in "a" are not in "set"
159  * cap_issubset(1111, 0101) will return 0
160  */
161 static inline int cap_issubset(const kernel_cap_t a, const kernel_cap_t set)
162 {
164  dest = cap_drop(a, set);
165  return cap_isclear(dest);
166 }
167 
168 /* Used to decide between falling back on the old suser() or fsuser(). */
169 
170 static inline int cap_is_fs_cap(int cap)
171 {
172  const kernel_cap_t __cap_fs_set = CAP_FS_SET;
173  return !!(CAP_TO_MASK(cap) & __cap_fs_set.cap[CAP_TO_INDEX(cap)]);
174 }
175 
176 static inline kernel_cap_t cap_drop_fs_set(const kernel_cap_t a)
177 {
178  const kernel_cap_t __cap_fs_set = CAP_FS_SET;
179  return cap_drop(a, __cap_fs_set);
180 }
181 
182 static inline kernel_cap_t cap_raise_fs_set(const kernel_cap_t a,
183  const kernel_cap_t permitted)
184 {
185  const kernel_cap_t __cap_fs_set = CAP_FS_SET;
186  return cap_combine(a,
187  cap_intersect(permitted, __cap_fs_set));
188 }
189 
190 static inline kernel_cap_t cap_drop_nfsd_set(const kernel_cap_t a)
191 {
192  const kernel_cap_t __cap_fs_set = CAP_NFSD_SET;
193  return cap_drop(a, __cap_fs_set);
194 }
195 
196 static inline kernel_cap_t cap_raise_nfsd_set(const kernel_cap_t a,
197  const kernel_cap_t permitted)
198 {
199  const kernel_cap_t __cap_nfsd_set = CAP_NFSD_SET;
200  return cap_combine(a,
201  cap_intersect(permitted, __cap_nfsd_set));
202 }
203 
204 extern bool has_capability(struct task_struct *t, int cap);
205 extern bool has_ns_capability(struct task_struct *t,
206  struct user_namespace *ns, int cap);
207 extern bool has_capability_noaudit(struct task_struct *t, int cap);
208 extern bool has_ns_capability_noaudit(struct task_struct *t,
209  struct user_namespace *ns, int cap);
210 extern bool capable(int cap);
211 extern bool ns_capable(struct user_namespace *ns, int cap);
212 extern bool nsown_capable(int cap);
213 extern bool inode_capable(const struct inode *inode, int cap);
214 
215 /* audit system wants to get cap info from files as well */
216 extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
217 
218 #endif /* !_LINUX_CAPABILITY_H */