[PATCH 1/3] exporting capability code/name pairs (try 2nd)

* [PATCH 1/3] exporting capability code/name pairs (try 2nd)
@ 2008-01-25  5:18 Kohei KaiGai
  2008-01-25  7:32 ` Andrew G. Morgan
  0 siblings, 1 reply; 34+ messages in thread
From: Kohei KaiGai @ 2008-01-25  5:18 UTC (permalink / raw)
  To: akpm; +Cc: morgan, serue, jmorris, linux-kernel, linux-security-module

We can apply this patch to kernel-2.6.24.
It enables to export code/name pairs of capabilities
at /sys/kernel/capability/, as follows:

--------
[root@saba ~]# ls /sys/kernel/capability/
cap_audit_control    cap_kill              cap_setgid      cap_sys_ptrace
cap_audit_write      cap_lease             cap_setpcap     cap_sys_rawio
cap_chown            cap_linux_immutable   cap_setuid      cap_sys_resource
cap_dac_override     cap_mknod             cap_sys_admin   cap_sys_time
cap_dac_read_search  cap_net_admin         cap_sys_boot    cap_sys_tty_config
cap_fowner           cap_net_bind_service  cap_sys_chroot  index
cap_fsetid           cap_net_broadcast     cap_sys_module  version
cap_ipc_lock         cap_net_raw           cap_sys_nice
cap_ipc_owner        cap_setfcap           cap_sys_pacct
[root@saba ~]# cat /sys/kernel/capability/cap_setfcap
31
[root@saba ~]# cat /sys/kernel/capability/version
0x19980330
[root@saba ~]#
--------

In the previous version of kernel, we have no way to obtain
what capabilities are supported in this running kernel.

The libcap is a library to provide fundamental facilities
to handle capabilities. It has to be rebuilt when new
capabilities are added, because it statically holds the
list of all capabilities generated from kernel header
automatically on its build environment.

This patch enables libcap to obtain these infomation dynamically,
and improves userspace portability.

Please consider to apply these patches.
Thanks,
----
Signed-off-by: KaiGai Kohei <kaigai@ak.jp.nec.com>

 kernel/Makefile       |    9 ++++++++
 kernel/capability.c   |   36 +++++++++++++++++++++++++++++++++++
 scripts/mkcapnames.sh |   50 +++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 95 insertions(+), 0 deletions(-)

diff --git a/kernel/Makefile b/kernel/Makefile
index dfa9695..29cd3ac 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -80,3 +80,12 @@ quiet_cmd_ikconfiggz = IKCFG   $@
 targets += config_data.h
 $(obj)/config_data.h: $(obj)/config_data.gz FORCE
 	$(call if_changed,ikconfiggz)
+
+# cap_names.h contains the code/name pair of capabilities.
+# It is generated using include/linux/capability.h automatically.
+$(obj)/capability.o: $(obj)/cap_names.h
+quiet_cmd_cap_names  = CAPS    $@
+      cmd_cap_names  = /bin/sh $(src)/../scripts/mkcapnames.sh > $@
+targets += cap_names.h
+$(obj)/cap_names.h: $(src)/../scripts/mkcapnames.sh $(src)/../include/linux/capability.h FORCE
+	$(call if_changed,cap_names)
diff --git a/kernel/capability.c b/kernel/capability.c
index efbd9cd..14b4f4b 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -245,3 +245,39 @@ int capable(int cap)
 	return __capable(current, cap);
 }
 EXPORT_SYMBOL(capable);
+
+/*
+ * Export the list of capabilities on /sys/kernel/capability
+ */
+#define SYSFS_CAPABILITY_ENTRY(_name, _fmt, ...)			\
+	static ssize_t _name##_show(struct kset *kset, char *buffer)	\
+	{								\
+		return scnprintf(buffer, PAGE_SIZE, _fmt, __VA_ARGS__);	\
+	}								\
+	static struct subsys_attribute _name##_attr = __ATTR_RO(_name)
+
+/*
+ * capability_attrs[] is generated automatically by scripts/mkcapnames.sh
+ * This script parses include/linux/capability.h
+ */
+#include "cap_names.h"
+
+static struct attribute_group capability_attr_group = {
+	.name = "capability",
+	.attrs = capability_attrs,
+};
+
+static int __init capability_export_names(void)
+{
+	int rc;
+
+	rc = sysfs_create_group(&kernel_subsys.kobj,
+				&capability_attr_group);
+	if (rc) {
+		printk(KERN_ERR "Unable to export capabilities\n");
+		return rc;
+	}
+
+	return 0;
+}
+__initcall(capability_export_names);
diff --git a/scripts/mkcapnames.sh b/scripts/mkcapnames.sh
index e69de29..262478e 100644
--- a/scripts/mkcapnames.sh
+++ b/scripts/mkcapnames.sh
@@ -0,0 +1,50 @@
+#!/bin/sh
+
+#
+# generate a cap_names.h file from include/linux/capability.h
+#
+
+BASEDIR=`dirname $0`
+
+echo '#ifndef CAP_NAMES_H'
+echo '#define CAP_NAMES_H'
+echo
+echo '/*'
+echo ' * Do NOT edit this file directly.'
+echo ' * This file is generated from include/linux/capability.h automatically'
+echo ' */'
+echo
+echo '#ifndef SYSFS_CAPABILITY_ENTRY'
+echo '#error cap_names.h should be included from kernel/capability.c'
+echo '#else'
+
+echo 'SYSFS_CAPABILITY_ENTRY(version, "0x%08x\n", _LINUX_CAPABILITY_VERSION);'
+
+cat ${BASEDIR}/../include/linux/capability.h	\
+    | egrep '^#define CAP_[A-Z_]+[ 	]+[0-9]+$'	\
+    | awk 'BEGIN {
+            max_code = -1;
+        }
+        {
+            if ($3 > max_code)
+                max_code = $3;
+            printf("SYSFS_CAPABILITY_ENTRY(%s, \"%%u\\n\", %s);\n", tolower($2), $2);
+        }
+        END {
+            printf("SYSFS_CAPABILITY_ENTRY(index, \"%%u\\n\", %u);\n", max_code);
+        }'
+
+echo
+echo 'static struct attribute *capability_attrs[] = {'
+echo '        &version_attr.attr,'
+echo '        &index_attr.attr,'
+
+cat ${BASEDIR}/../include/linux/capability.h    \
+    | egrep '^#define CAP_[A-Z_]+[ 	]+[0-9]+$'   \
+    | awk '{ printf ("        &%s_attr.attr,\n", tolower($2)); }'
+
+echo '        NULL,'
+echo '};'
+
+echo '#endif	/* SYSFS_CAPABILITY_ENTRY */'
+echo '#endif	/* CAP_NAMES_H */'


-- 
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai@ak.jp.nec.com>

^ permalink raw reply related	[flat|nested] 34+ messages in thread