From patchwork Fri Aug 10 16:13:28 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Christian Brauner X-Patchwork-Id: 10562929 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 3556A90E3 for ; Fri, 10 Aug 2018 16:13:59 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 24DD52BC30 for ; Fri, 10 Aug 2018 16:13:59 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 196A62BDBA; Fri, 10 Aug 2018 16:13:59 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AAE142BC30 for ; Fri, 10 Aug 2018 16:13:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728217AbeHJSo0 (ORCPT ); Fri, 10 Aug 2018 14:44:26 -0400 Received: from mail-wm0-f67.google.com ([74.125.82.67]:55483 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727698AbeHJSo0 (ORCPT ); Fri, 10 Aug 2018 14:44:26 -0400 Received: by mail-wm0-f67.google.com with SMTP id f21-v6so2474083wmc.5 for ; Fri, 10 Aug 2018 09:13:55 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=D9ZaI3uIKz4EEou64aIb41y4oBb6agXjflCD//M8b/8=; b=VDOHvPRe7YrKKPrt5uSvXSIB0b3Gi6RMZh69Zi1e5HO2M9XIa24IEnuyyJ9IISShD6 Tgh398Y6or+tPTUL6OZ0p2wcht9QQ1LHU3Rp07i/Mz7LJ6zM4DRm403ATsdqD0LVZxBj /YoFJgTooFbC4vDrQkStmWoKhP2XuBN42Ha/iXlgYtt9xyIBHXTRs3YdyJOvf9KCcKks 97utAgjYJtk1x124GBIymoypzKsBkisBgrVKBti0CRClR7rvkWIHVWApT9HEwAM0efmb /6QvLTsSLMMMDwkDX3Fu4USziBlj0brv/WtQXP76B1WlI/pC9uOuWwm+wrSiTJg30oAv raXw== X-Gm-Message-State: AOUpUlHkwySeePIUaKvSFnKfkeXDVTceeMLETAdW/b5J7tUrLfkjePF4 2Bte+q4VQFY+w1e8s+EB/T41zG5osdc= X-Google-Smtp-Source: AA+uWPz7U9H8tkS9Bfr74gvDmv3VBNiioxFFL61dU7sfnug9X8FirYlOUwxVJldJMVE8i3ammBeDKw== X-Received: by 2002:a1c:cc17:: with SMTP id h23-v6mr1852120wmb.82.1533917634558; Fri, 10 Aug 2018 09:13:54 -0700 (PDT) Received: from localhost.localdomain (u-082-c008.eap.uni-tuebingen.de. [134.2.82.8]) by smtp.gmail.com with ESMTPSA id m13-v6sm9987615wru.93.2018.08.10.09.13.53 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 10 Aug 2018 09:13:53 -0700 (PDT) From: Christian Brauner To: linux-security-module@vger.kernel.org, containers@lists.linux-foundation.org Cc: serge@hallyn.com, morgan@kernel.org, Christian Brauner Subject: [PATCH 2/9] capability: update to new uapi header Date: Fri, 10 Aug 2018 18:13:28 +0200 Message-Id: <20180810161335.27036-3-christian@brauner.io> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180810161335.27036-1-christian@brauner.io> References: <20180810161335.27036-1-christian@brauner.io> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP I'm not completely sure why libcap effectively vendors a copy of the capability uapi header but I assume there's a good reason for it. But let's update it to the newest version. Signed-off-by: Christian Brauner Reviewed-by: Serge Hallyn --- libcap/include/uapi/linux/capability.h | 39 +++++++++++++++++--------- 1 file changed, 26 insertions(+), 13 deletions(-) diff --git a/libcap/include/uapi/linux/capability.h b/libcap/include/uapi/linux/capability.h index 432e023..4a2d916 100644 --- a/libcap/include/uapi/linux/capability.h +++ b/libcap/include/uapi/linux/capability.h @@ -1,3 +1,4 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ /* * This is * @@ -7,16 +8,14 @@ * * See here for the libcap library ("POSIX draft" compliance): * - * http://www.kernel.org/pub/linux/libs/security/linux-privs/ + * ftp://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.6/ */ -#ifndef _UAPI_LINUX_CAPABILITY_H -#define _UAPI_LINUX_CAPABILITY_H +#ifndef _LINUX_CAPABILITY_H +#define _LINUX_CAPABILITY_H #include -struct task_struct; - /* User-level do most of the mapping between kernel and user capabilities based on the version tag given by the kernel. The kernel might be somewhat backwards compatible, but don't bet on @@ -62,9 +61,13 @@ typedef struct __user_cap_data_struct { #define VFS_CAP_U32_2 2 #define XATTR_CAPS_SZ_2 (sizeof(__le32)*(1 + 2*VFS_CAP_U32_2)) -#define XATTR_CAPS_SZ XATTR_CAPS_SZ_2 -#define VFS_CAP_U32 VFS_CAP_U32_2 -#define VFS_CAP_REVISION VFS_CAP_REVISION_2 +#define VFS_CAP_REVISION_3 0x03000000 +#define VFS_CAP_U32_3 2 +#define XATTR_CAPS_SZ_3 (sizeof(__le32)*(2 + 2*VFS_CAP_U32_3)) + +#define XATTR_CAPS_SZ XATTR_CAPS_SZ_3 +#define VFS_CAP_U32 VFS_CAP_U32_3 +#define VFS_CAP_REVISION VFS_CAP_REVISION_3 struct vfs_cap_data { __le32 magic_etc; /* Little endian */ @@ -74,7 +77,18 @@ struct vfs_cap_data { } data[VFS_CAP_U32]; }; -#ifndef __KERNEL__ +/* + * same as vfs_cap_data but with a rootid at the end + */ +struct vfs_ns_cap_data { + __le32 magic_etc; + struct { + __le32 permitted; /* Little endian */ + __le32 inheritable; /* Little endian */ + } data[VFS_CAP_U32]; + __le32 rootid; +}; + /* * Backwardly compatible definition for source code - trapped in a @@ -84,7 +98,6 @@ struct vfs_cap_data { #define _LINUX_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_1 #define _LINUX_CAPABILITY_U32S _LINUX_CAPABILITY_U32S_1 -#endif /** @@ -207,7 +220,7 @@ struct vfs_cap_data { #define CAP_SYS_MODULE 16 /* Allow ioperm/iopl access */ -/* Allow sending USB messages to any device via /proc/bus/usb */ +/* Allow sending USB messages to any device via /dev/bus/usb */ #define CAP_SYS_RAWIO 17 @@ -349,7 +362,7 @@ struct vfs_cap_data { /* Allow reading the audit log via multicast netlink socket */ -#define CAP_AUDIT_READ 37 +#define CAP_AUDIT_READ 37 #define CAP_LAST_CAP CAP_AUDIT_READ @@ -364,4 +377,4 @@ struct vfs_cap_data { #define CAP_TO_MASK(x) (1 << ((x) & 31)) /* mask for indexed __u32 */ -#endif /* _UAPI_LINUX_CAPABILITY_H */ +#endif /* _LINUX_CAPABILITY_H */