DL-Mirrors/kernel-tenderloin-3.0
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: Add AID_NET_RAW and AID_NET_ADMIN capability check in cap_capable().

Browse Source 
Signed-off-by: Chia-chi Yeh <chiachi@android.com>
This commit is contained in:
Chia-chi Yeh
2009-06-19 07:15:05 +08:00
committed by Colin Cross
parent 764fc0ee29
commit 622495a5ad
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/android_aid.h
View File

@@ -21,5 +21,6 @@
#define AID_NET_BT 3002 #define AID_NET_BT 3002
#define AID_INET 3003 #define AID_INET 3003
#define AID_NET_RAW 3004 #define AID_NET_RAW 3004
#define AID_NET_ADMIN 3005
#endif #endif

9
security/commoncap.c
View File

@@ -29,6 +29,10 @@
#include <linux/securebits.h> #include <linux/securebits.h>
#include <linux/user_namespace.h> #include <linux/user_namespace.h>
#ifdef CONFIG_ANDROID_PARANOID_NETWORK
#include <linux/android_aid.h>
#endif
/* /*
* If a non-root user executes a setuid-root binary in * If a non-root user executes a setuid-root binary in
* !secure(SECURE_NOROOT) mode, then we raise capabilities. * !secure(SECURE_NOROOT) mode, then we raise capabilities.
@@ -83,6 +87,11 @@ EXPORT_SYMBOL(cap_netlink_recv);
int cap_capable(struct task_struct *tsk, const struct cred *cred, int cap_capable(struct task_struct *tsk, const struct cred *cred,
struct user_namespace *targ_ns, int cap, int audit) struct user_namespace *targ_ns, int cap, int audit)
{ {
if (cap == CAP_NET_RAW && in_egroup_p(AID_NET_RAW))
return 0;
if (cap == CAP_NET_ADMIN && in_egroup_p(AID_NET_ADMIN))
return 0;
for (;;) { for (;;) {
/* The creator of the user namespace has all caps. */ /* The creator of the user namespace has all caps. */
if (targ_ns != &init_user_ns && targ_ns->creator == cred->user) if (targ_ns != &init_user_ns && targ_ns->creator == cred->user)