capability.c 2.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101
  1. /*
  2. * Capabilities Linux Security Module
  3. *
  4. * This program is free software; you can redistribute it and/or modify
  5. * it under the terms of the GNU General Public License as published by
  6. * the Free Software Foundation; either version 2 of the License, or
  7. * (at your option) any later version.
  8. *
  9. */
  10. #include <linux/module.h>
  11. #include <linux/init.h>
  12. #include <linux/kernel.h>
  13. #include <linux/security.h>
  14. #include <linux/file.h>
  15. #include <linux/mm.h>
  16. #include <linux/mman.h>
  17. #include <linux/pagemap.h>
  18. #include <linux/swap.h>
  19. #include <linux/smp_lock.h>
  20. #include <linux/skbuff.h>
  21. #include <linux/netlink.h>
  22. #include <linux/ptrace.h>
  23. #include <linux/moduleparam.h>
  24. static struct security_operations capability_ops = {
  25. .ptrace = cap_ptrace,
  26. .capget = cap_capget,
  27. .capset_check = cap_capset_check,
  28. .capset_set = cap_capset_set,
  29. .capable = cap_capable,
  30. .settime = cap_settime,
  31. .netlink_send = cap_netlink_send,
  32. .netlink_recv = cap_netlink_recv,
  33. .bprm_apply_creds = cap_bprm_apply_creds,
  34. .bprm_set_security = cap_bprm_set_security,
  35. .bprm_secureexec = cap_bprm_secureexec,
  36. .inode_setxattr = cap_inode_setxattr,
  37. .inode_removexattr = cap_inode_removexattr,
  38. .task_post_setuid = cap_task_post_setuid,
  39. .task_reparent_to_init = cap_task_reparent_to_init,
  40. .syslog = cap_syslog,
  41. .vm_enough_memory = cap_vm_enough_memory,
  42. };
  43. /* flag to keep track of how we were registered */
  44. static int secondary;
  45. static int capability_disable;
  46. module_param_named(disable, capability_disable, int, 0);
  47. MODULE_PARM_DESC(disable, "To disable capabilities module set disable = 1");
  48. static int __init capability_init (void)
  49. {
  50. if (capability_disable) {
  51. printk(KERN_INFO "Capabilities disabled at initialization\n");
  52. return 0;
  53. }
  54. /* register ourselves with the security framework */
  55. if (register_security (&capability_ops)) {
  56. /* try registering with primary module */
  57. if (mod_reg_security (KBUILD_MODNAME, &capability_ops)) {
  58. printk (KERN_INFO "Failure registering capabilities "
  59. "with primary security module.\n");
  60. return -EINVAL;
  61. }
  62. secondary = 1;
  63. }
  64. printk (KERN_INFO "Capability LSM initialized%s\n",
  65. secondary ? " as secondary" : "");
  66. return 0;
  67. }
  68. static void __exit capability_exit (void)
  69. {
  70. if (capability_disable)
  71. return;
  72. /* remove ourselves from the security framework */
  73. if (secondary) {
  74. if (mod_unreg_security (KBUILD_MODNAME, &capability_ops))
  75. printk (KERN_INFO "Failure unregistering capabilities "
  76. "with primary module.\n");
  77. return;
  78. }
  79. if (unregister_security (&capability_ops)) {
  80. printk (KERN_INFO
  81. "Failure unregistering capabilities with the kernel\n");
  82. }
  83. }
  84. security_initcall (capability_init);
  85. module_exit (capability_exit);
  86. MODULE_DESCRIPTION("Standard Linux Capabilities Security Module");
  87. MODULE_LICENSE("GPL");