Re: [PATCH 0/3] exporting capability name/code pairs (for 2.6.26)

[KaiGai Kohei <kaigai@ak.jp.nec.com>]

Alexey Dobriyan wrote:
> On Tue, Apr 22, 2008 at 08:12:15PM +0900, KaiGai Kohei wrote:
>> $ ls -R /sys/kernel/capability/
>> /sys/kernel/capability/:
>> codes  names  version
>>
>> /sys/kernel/capability/codes:
>> 0  10  12  14  16  18  2   21  23  25  27  29  30  32  4  6  8
>> 1  11  13  15  17  19  20  22  24  26  28  3   31  33  5  7  9
>>
>> /sys/kernel/capability/names:
>> cap_audit_control    cap_kill              cap_net_raw     cap_sys_nice
>> cap_audit_write      cap_lease             cap_setfcap     cap_sys_pacct
>> cap_chown            cap_linux_immutable   cap_setgid      cap_sys_ptrace
>> cap_dac_override     cap_mac_admin         cap_setpcap     cap_sys_rawio
>> cap_dac_read_search  cap_mac_override      cap_setuid      cap_sys_resource
>> cap_fowner           cap_mknod             cap_sys_admin   cap_sys_time
>> cap_fsetid           cap_net_admin         cap_sys_boot    cap_sys_tty_config
>> cap_ipc_lock         cap_net_bind_service  cap_sys_chroot
>> cap_ipc_owner        cap_net_broadcast     cap_sys_module
>> $ cat /sys/kernel/capability/names/cap_sys_pacct
>> 20
>> $ cat /sys/kernel/capability/codes/16
>> cap_sys_module
> 
> This is amazing amount of bloat for such conceptually simple feature!
> 
> Below is /proc/capabilities ,
> a) without all memory eaten by sysfs files and directories,
>    generated on the fly
> b) with capability names matching the ones in manpages
> c) nicely formatted
> e) with whole-whooping 2 lines of protection from fool
> 	(including helpful directions)
>   Proposed regexp of course will incorrectly match someday
> 
> If this file will be used often, I can even make whole its content
> become generated at compile time and then put into buffers
> with 1 (one) seq_puts()!

I had suggested a similar idea previously, but it could not be supported
because it requires to scan whole of /proc/capabilities at first.

Using sysfs enables to translate them without seeking, as Andrew Morgan said.

> 	Alexey "0	CAP_CHOWN
> 		1	CAP_DAC_OVERRIDE
> 		2	CAP_DAC_READ_SEARCH
> 		3	CAP_FOWNER
> 		4	CAP_FSETID
> 		5	CAP_KILL
> 		6	CAP_SETGID
> 		7	CAP_SETUID
> 		8	CAP_SETPCAP
> 		9	CAP_LINUX_IMMUTABLE
> 		10	CAP_NET_BIND_SERVICE
> 		11	CAP_NET_BROADCAST
> 		12	CAP_NET_ADMIN
> 		13	CAP_NET_RAW
> 		14	CAP_IPC_LOCK
> 		15	CAP_IPC_OWNER
> 		16	CAP_SYS_MODULE
> 		17	CAP_SYS_RAWIO
> 		18	CAP_SYS_CHROOT
> 		19	CAP_SYS_PTRACE
> 		20	CAP_SYS_PACCT
> 		21	CAP_SYS_ADMIN
> 		22	CAP_SYS_BOOT
> 		23	CAP_SYS_NICE
> 		24	CAP_SYS_RESOURCE
> 		25	CAP_SYS_TIME
> 		26	CAP_SYS_TTY_CONFIG
> 		27	CAP_MKNOD
> 		28	CAP_LEASE
> 		29	CAP_AUDIT_WRITE
> 		30	CAP_AUDIT_CONTROL
> 		31	CAP_SETFCAP
> 		32	CAP_MAC_OVERRIDE
> 		33	CAP_MAC_ADMIN"	Dobriyan
> 
> --- a/security/commoncap.c
> +++ b/security/commoncap.c
> @@ -19,6 +19,8 @@
>  #include <linux/swap.h>
>  #include <linux/skbuff.h>
>  #include <linux/netlink.h>
> +#include <linux/proc_fs.h>
> +#include <linux/seq_file.h>
>  #include <linux/ptrace.h>
>  #include <linux/xattr.h>
>  #include <linux/hugetlb.h>
> @@ -597,3 +599,81 @@ int cap_vm_enough_memory(struct mm_struct *mm, long pages)
>  	return __vm_enough_memory(mm, pages, cap_sys_admin);
>  }
>  
> +#ifdef CONFIG_PROC_FS
> +static const struct {
> +	int val;
> +	const char *str;
> +} proc_cap[] = {
> +#define _(cap) { .val = cap, .str = #cap }
> +	_(CAP_CHOWN),
> +	_(CAP_DAC_OVERRIDE),
> +	_(CAP_DAC_READ_SEARCH),
> +	_(CAP_FOWNER),
> +	_(CAP_FSETID),
> +	_(CAP_KILL),
> +	_(CAP_SETGID),
> +	_(CAP_SETUID),
> +	_(CAP_SETPCAP),
> +	_(CAP_LINUX_IMMUTABLE),
> +	_(CAP_NET_BIND_SERVICE),
> +	_(CAP_NET_BROADCAST),
> +	_(CAP_NET_ADMIN),
> +	_(CAP_NET_RAW),
> +	_(CAP_IPC_LOCK),
> +	_(CAP_IPC_OWNER),
> +	_(CAP_SYS_MODULE),
> +	_(CAP_SYS_RAWIO),
> +	_(CAP_SYS_CHROOT),
> +	_(CAP_SYS_PTRACE),
> +	_(CAP_SYS_PACCT),
> +	_(CAP_SYS_ADMIN),
> +	_(CAP_SYS_BOOT),
> +	_(CAP_SYS_NICE),
> +	_(CAP_SYS_RESOURCE),
> +	_(CAP_SYS_TIME),
> +	_(CAP_SYS_TTY_CONFIG),
> +	_(CAP_MKNOD),
> +	_(CAP_LEASE),
> +	_(CAP_AUDIT_WRITE),
> +	_(CAP_AUDIT_CONTROL),
> +	_(CAP_SETFCAP),
> +	_(CAP_MAC_OVERRIDE),
> +	_(CAP_MAC_ADMIN),
> +#undef _

It should be generated automatically.
and, where is the "version" information?

> +};
> +
> +static int proc_capabilities_show(struct seq_file *m, void *v)
> +{
> +	int i;
> +
> +	for (i = 0; i < ARRAY_SIZE(proc_cap); i++)
> +		seq_printf(m, "%d\t%s\n", proc_cap[i].val, proc_cap[i].str);
> +	return 0;
> +}
> +
> +static int proc_capabilities_open(struct inode *inode, struct file *file)
> +{
> +	return single_open(file, proc_capabilities_show, NULL);
> +}
> +
> +static const struct file_operations capabilities_proc_fops = {
> +	.owner		= THIS_MODULE,
> +	.open		= proc_capabilities_open,
> +	.read		= seq_read,
> +	.llseek		= seq_lseek,
> +	.release	= single_release,
> +};
> +
> +static int __init commoncap_init(void)
> +{
> +	struct proc_dir_entry *pde;
> +
> +	pde = proc_create("capabilities", 0, NULL, &capabilities_proc_fops);
> +	if (!pde)
> +		return -ENOMEM;
> +	/* Forgot to add new capability to proc_cap array? */
> +	BUILD_BUG_ON(ARRAY_SIZE(proc_cap) != CAP_LAST_CAP + 1);
> +	return 0;
> +}
> +module_init(commoncap_init);
> +#endif
> 
> 


-- 
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai@ak.jp.nec.com>