util: introduce our own gperf based capability list

This way, we can ensure we have a more complete, up-to-date list of
capabilities around, always.

5 files changed, 120 insertions, 3 deletions

diff --git a/src/shared/.gitignore b/src/shared/.gitignore
index 61709e8da1..e22411e484 100644
--- a/src/shared/.gitignore
+++ b/src/shared/.gitignore
@@ -1,3 +1,7 @@
+/cap-from-name.gperf
+/cap-from-name.h
+/cap-list.txt
+/cap-to-name.h
 /errno-from-name.gperf
 /errno-from-name.h
 /errno-list.txt
diff --git a/src/shared/cap-list.c b/src/shared/cap-list.c
new file mode 100644
index 0000000000..56d1488f48
--- /dev/null
+++ b/src/shared/cap-list.c
@@ -0,0 +1,62 @@
+/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
+
+/***
+  This file is part of systemd.
+
+  Copyright 2014 Lennart Poettering
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+#include <linux/capability.h>
+#include <string.h>
+
+#include "util.h"
+#include "cap-list.h"
+#include "missing.h"
+
+static const struct capability_name* lookup_capability(register const char *str, register unsigned int len);
+
+#include "cap-to-name.h"
+#include "cap-from-name.h"
+
+const char *capability_to_name(int id) {
+
+        if (id < 0)
+                return NULL;
+
+        if (id >= (int) ELEMENTSOF(capability_names))
+                return NULL;
+
+        return capability_names[id];
+}
+
+int capability_from_name(const char *name) {
+        const struct capability_name *sc;
+        int r, i;
+
+        assert(name);
+
+        /* Try to parse numeric capability */
+        r = safe_atoi(name, &i);
+        if (r >= 0 && i >= 0)
+                return i;
+
+        /* Try to parse string capability */
+        sc = lookup_capability(name, strlen(name));
+        if (!sc)
+                return -EINVAL;
+
+        return sc->id;
+}
diff --git a/src/shared/cap-list.h b/src/shared/cap-list.h
new file mode 100644
index 0000000000..c699e466a7
--- /dev/null
+++ b/src/shared/cap-list.h
@@ -0,0 +1,25 @@
+/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
+
+#pragma once
+
+/***
+  This file is part of systemd.
+
+  Copyright 2014 Lennart Poettering
+
+  systemd is free software; you can redistribute it and/or modify it
+  under the terms of the GNU Lesser General Public License as published by
+  the Free Software Foundation; either version 2.1 of the License, or
+  (at your option) any later version.
+
+  systemd is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public License
+  along with systemd; If not, see <http://www.gnu.org/licenses/>.
+***/
+
+const char *capability_to_name(int id);
+int capability_from_name(const char *name);
diff --git a/src/shared/condition.c b/src/shared/condition.c
index 59f262244b..dcbf9a7e86 100644
--- a/src/shared/condition.c
+++ b/src/shared/condition.c
@@ -39,6 +39,7 @@
 #include "selinux-util.h"
 #include "audit.h"
 #include "condition.h"
+#include "cap-list.h"
 
 Condition* condition_new(ConditionType type, const char *parameter, bool trigger, bool negate) {
         Condition *c;
@@ -235,7 +236,7 @@ static int condition_test_security(Condition *c) {
 
 static int condition_test_capability(Condition *c) {
         _cleanup_fclose_ FILE *f = NULL;
-        cap_value_t value;
+        int value;
         char line[LINE_MAX];
         unsigned long long capabilities = -1;
 
@@ -244,8 +245,8 @@ static int condition_test_capability(Condition *c) {
         assert(c->type == CONDITION_CAPABILITY);
 
         /* If it's an invalid capability, we don't have it */
-
-        if (cap_from_name(c->parameter, &value) < 0)
+        value = capability_from_name(c->parameter);
+        if (value < 0)
                 return -EINVAL;
 
         /* If it's a valid capability we default to assume
diff --git a/src/shared/missing.h b/src/shared/missing.h
index cf7387751c..478988c8a4 100644
--- a/src/shared/missing.h
+++ b/src/shared/missing.h
@@ -34,6 +34,7 @@
 #include <linux/if_link.h>
 #include <linux/loop.h>
 #include <linux/audit.h>
+#include <linux/capability.h>
 
 #ifdef HAVE_AUDIT
 #include <libaudit.h>
@@ -606,3 +607,27 @@ static inline int setns(int fd, int nstype) {
 #ifndef AUDIT_NLGRP_MAX
 #define AUDIT_NLGRP_READLOG 1
 #endif
+
+#ifndef CAP_MAC_OVERRIDE
+#define CAP_MAC_OVERRIDE 32
+#endif
+
+#ifndef CAP_MAC_ADMIN
+#define CAP_MAC_ADMIN 33
+#endif
+
+#ifndef CAP_SYSLOG
+#define CAP_SYSLOG 34
+#endif
+
+#ifndef CAP_WAKE_ALARM
+#define CAP_WAKE_ALARM 35
+#endif
+
+#ifndef CAP_BLOCK_SUSPEND
+#define CAP_BLOCK_SUSPEND 36
+#endif
+
+#ifndef CAP_AUDIT_READ
+#define CAP_AUDIT_READ 37
+#endif