Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
tjh.dev
kernel
os
linux
1/*
2 * Capabilities Linux Security Module
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation; either version 2 of the License, or
7 * (at your option) any later version.
8 *
9 */
10
11#include <linux/module.h>
12#include <linux/init.h>
13#include <linux/kernel.h>
14#include <linux/security.h>
15#include <linux/file.h>
16#include <linux/mm.h>
17#include <linux/mman.h>
18#include <linux/pagemap.h>
19#include <linux/swap.h>
20#include <linux/skbuff.h>
21#include <linux/netlink.h>
22#include <linux/ptrace.h>
23#include <linux/moduleparam.h>
24
25static struct security_operations capability_ops = {
26 .ptrace = cap_ptrace,
27 .capget = cap_capget,
28 .capset_check = cap_capset_check,
29 .capset_set = cap_capset_set,
30 .capable = cap_capable,
31 .settime = cap_settime,
32 .netlink_send = cap_netlink_send,
33 .netlink_recv = cap_netlink_recv,
34
35 .bprm_apply_creds = cap_bprm_apply_creds,
36 .bprm_set_security = cap_bprm_set_security,
37 .bprm_secureexec = cap_bprm_secureexec,
38
39 .inode_setxattr = cap_inode_setxattr,
40 .inode_removexattr = cap_inode_removexattr,
41
42 .task_post_setuid = cap_task_post_setuid,
43 .task_reparent_to_init = cap_task_reparent_to_init,
44
45 .syslog = cap_syslog,
46
47 .vm_enough_memory = cap_vm_enough_memory,
48};
49
50/* flag to keep track of how we were registered */
51static int secondary;
52
53static int capability_disable;
54module_param_named(disable, capability_disable, int, 0);
55MODULE_PARM_DESC(disable, "To disable capabilities module set disable = 1");
56
57static int __init capability_init (void)
58{
59 if (capability_disable) {
60 printk(KERN_INFO "Capabilities disabled at initialization\n");
61 return 0;
62 }
63 /* register ourselves with the security framework */
64 if (register_security (&capability_ops)) {
65 /* try registering with primary module */
66 if (mod_reg_security (KBUILD_MODNAME, &capability_ops)) {
67 printk (KERN_INFO "Failure registering capabilities "
68 "with primary security module.\n");
69 return -EINVAL;
70 }
71 secondary = 1;
72 }
73 printk (KERN_INFO "Capability LSM initialized%s\n",
74 secondary ? " as secondary" : "");
75 return 0;
76}
77
78static void __exit capability_exit (void)
79{
80 if (capability_disable)
81 return;
82 /* remove ourselves from the security framework */
83 if (secondary) {
84 if (mod_unreg_security (KBUILD_MODNAME, &capability_ops))
85 printk (KERN_INFO "Failure unregistering capabilities "
86 "with primary module.\n");
87 return;
88 }
89
90 if (unregister_security (&capability_ops)) {
91 printk (KERN_INFO
92 "Failure unregistering capabilities with the kernel\n");
93 }
94}
95
96security_initcall (capability_init);
97module_exit (capability_exit);
98
99MODULE_DESCRIPTION("Standard Linux Capabilities Security Module");
100MODULE_LICENSE("GPL");