diff options
Diffstat (limited to 'src/shared')
| -rw-r--r-- | src/shared/.gitignore | 4 | ||||
| -rw-r--r-- | src/shared/cap-list.c | 62 | ||||
| -rw-r--r-- | src/shared/cap-list.h | 25 | ||||
| -rw-r--r-- | src/shared/condition.c | 7 | ||||
| -rw-r--r-- | src/shared/missing.h | 25 |
5 files changed, 120 insertions, 3 deletions
diff --git a/src/shared/.gitignore b/src/shared/.gitignore index 61709e8da1..e22411e484 100644 --- a/src/shared/.gitignore +++ b/src/shared/.gitignore @@ -1,3 +1,7 @@ +/cap-from-name.gperf +/cap-from-name.h +/cap-list.txt +/cap-to-name.h /errno-from-name.gperf /errno-from-name.h /errno-list.txt diff --git a/src/shared/cap-list.c b/src/shared/cap-list.c new file mode 100644 index 0000000000..56d1488f48 --- /dev/null +++ b/src/shared/cap-list.c @@ -0,0 +1,62 @@ +/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/ + +/*** + This file is part of systemd. + + Copyright 2014 Lennart Poettering + + systemd is free software; you can redistribute it and/or modify it + under the terms of the GNU Lesser General Public License as published by + the Free Software Foundation; either version 2.1 of the License, or + (at your option) any later version. + + systemd is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public License + along with systemd; If not, see <http://www.gnu.org/licenses/>. +***/ + +#include <linux/capability.h> +#include <string.h> + +#include "util.h" +#include "cap-list.h" +#include "missing.h" + +static const struct capability_name* lookup_capability(register const char *str, register unsigned int len); + +#include "cap-to-name.h" +#include "cap-from-name.h" + +const char *capability_to_name(int id) { + + if (id < 0) + return NULL; + + if (id >= (int) ELEMENTSOF(capability_names)) + return NULL; + + return capability_names[id]; +} + +int capability_from_name(const char *name) { + const struct capability_name *sc; + int r, i; + + assert(name); + + /* Try to parse numeric capability */ + r = safe_atoi(name, &i); + if (r >= 0 && i >= 0) + return i; + + /* Try to parse string capability */ + sc = lookup_capability(name, strlen(name)); + if (!sc) + return -EINVAL; + + return sc->id; +} diff --git a/src/shared/cap-list.h b/src/shared/cap-list.h new file mode 100644 index 0000000000..c699e466a7 --- /dev/null +++ b/src/shared/cap-list.h @@ -0,0 +1,25 @@ +/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/ + +#pragma once + +/*** + This file is part of systemd. + + Copyright 2014 Lennart Poettering + + systemd is free software; you can redistribute it and/or modify it + under the terms of the GNU Lesser General Public License as published by + the Free Software Foundation; either version 2.1 of the License, or + (at your option) any later version. + + systemd is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public License + along with systemd; If not, see <http://www.gnu.org/licenses/>. +***/ + +const char *capability_to_name(int id); +int capability_from_name(const char *name); diff --git a/src/shared/condition.c b/src/shared/condition.c index 59f262244b..dcbf9a7e86 100644 --- a/src/shared/condition.c +++ b/src/shared/condition.c @@ -39,6 +39,7 @@ #include "selinux-util.h" #include "audit.h" #include "condition.h" +#include "cap-list.h" Condition* condition_new(ConditionType type, const char *parameter, bool trigger, bool negate) { Condition *c; @@ -235,7 +236,7 @@ static int condition_test_security(Condition *c) { static int condition_test_capability(Condition *c) { _cleanup_fclose_ FILE *f = NULL; - cap_value_t value; + int value; char line[LINE_MAX]; unsigned long long capabilities = -1; @@ -244,8 +245,8 @@ static int condition_test_capability(Condition *c) { assert(c->type == CONDITION_CAPABILITY); /* If it's an invalid capability, we don't have it */ - - if (cap_from_name(c->parameter, &value) < 0) + value = capability_from_name(c->parameter); + if (value < 0) return -EINVAL; /* If it's a valid capability we default to assume diff --git a/src/shared/missing.h b/src/shared/missing.h index cf7387751c..478988c8a4 100644 --- a/src/shared/missing.h +++ b/src/shared/missing.h @@ -34,6 +34,7 @@ #include <linux/if_link.h> #include <linux/loop.h> #include <linux/audit.h> +#include <linux/capability.h> #ifdef HAVE_AUDIT #include <libaudit.h> @@ -606,3 +607,27 @@ static inline int setns(int fd, int nstype) { #ifndef AUDIT_NLGRP_MAX #define AUDIT_NLGRP_READLOG 1 #endif + +#ifndef CAP_MAC_OVERRIDE +#define CAP_MAC_OVERRIDE 32 +#endif + +#ifndef CAP_MAC_ADMIN +#define CAP_MAC_ADMIN 33 +#endif + +#ifndef CAP_SYSLOG +#define CAP_SYSLOG 34 +#endif + +#ifndef CAP_WAKE_ALARM +#define CAP_WAKE_ALARM 35 +#endif + +#ifndef CAP_BLOCK_SUSPEND +#define CAP_BLOCK_SUSPEND 36 +#endif + +#ifndef CAP_AUDIT_READ +#define CAP_AUDIT_READ 37 +#endif |