blob: 2c6e06d18fabfe7d9f10378f0cf9b353f7299962 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * Capabilities Linux Security Module
3 *
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation; either version 2 of the License, or
7 * (at your option) any later version.
8 *
9 */
10
Linus Torvalds1da177e2005-04-16 15:20:36 -070011#include <linux/init.h>
12#include <linux/kernel.h>
13#include <linux/security.h>
14#include <linux/file.h>
15#include <linux/mm.h>
16#include <linux/mman.h>
17#include <linux/pagemap.h>
18#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070019#include <linux/skbuff.h>
20#include <linux/netlink.h>
21#include <linux/ptrace.h>
22#include <linux/moduleparam.h>
23
24static struct security_operations capability_ops = {
25 .ptrace = cap_ptrace,
26 .capget = cap_capget,
27 .capset_check = cap_capset_check,
28 .capset_set = cap_capset_set,
29 .capable = cap_capable,
30 .settime = cap_settime,
31 .netlink_send = cap_netlink_send,
32 .netlink_recv = cap_netlink_recv,
33
34 .bprm_apply_creds = cap_bprm_apply_creds,
35 .bprm_set_security = cap_bprm_set_security,
36 .bprm_secureexec = cap_bprm_secureexec,
37
38 .inode_setxattr = cap_inode_setxattr,
39 .inode_removexattr = cap_inode_removexattr,
Serge E. Hallynb5376772007-10-16 23:31:36 -070040 .inode_need_killpriv = cap_inode_need_killpriv,
41 .inode_killpriv = cap_inode_killpriv,
Linus Torvalds1da177e2005-04-16 15:20:36 -070042
Serge E. Hallynb5376772007-10-16 23:31:36 -070043 .task_setscheduler = cap_task_setscheduler,
44 .task_setioprio = cap_task_setioprio,
45 .task_setnice = cap_task_setnice,
Linus Torvalds1da177e2005-04-16 15:20:36 -070046 .task_post_setuid = cap_task_post_setuid,
47 .task_reparent_to_init = cap_task_reparent_to_init,
48
49 .syslog = cap_syslog,
50
51 .vm_enough_memory = cap_vm_enough_memory,
52};
53
Linus Torvalds1da177e2005-04-16 15:20:36 -070054/* flag to keep track of how we were registered */
55static int secondary;
56
57static int capability_disable;
58module_param_named(disable, capability_disable, int, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -070059
60static int __init capability_init (void)
61{
62 if (capability_disable) {
63 printk(KERN_INFO "Capabilities disabled at initialization\n");
64 return 0;
65 }
66 /* register ourselves with the security framework */
67 if (register_security (&capability_ops)) {
68 /* try registering with primary module */
Sam Ravnborg367cb702006-01-06 21:17:50 +010069 if (mod_reg_security (KBUILD_MODNAME, &capability_ops)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -070070 printk (KERN_INFO "Failure registering capabilities "
71 "with primary security module.\n");
72 return -EINVAL;
73 }
74 secondary = 1;
75 }
76 printk (KERN_INFO "Capability LSM initialized%s\n",
77 secondary ? " as secondary" : "");
78 return 0;
79}
80
Linus Torvalds1da177e2005-04-16 15:20:36 -070081security_initcall (capability_init);