exporting capability code/name pairs (try 2nd)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

KaiGai,

While this is cute :-), I guess I'm still not all that convinced that this is needed.

libcap already had some (admittedly not quite working) support for numeric values of capabilities not currently defined (which I believe is now fixed in top of trunk):

# ./setcap 35=i ./setcap
# ./getcap ./setcap
./setcap = 35+i

Although, I obviously can't argue that this is as readable as your approach, it does seem unlikely that the rate of addition of new capabilities will be all that great, and you can recompile everything capability related in user-space on a live system without a reboot.

Further, if anyone ever wants to translate the capabilities into another language, it seems like user-space is a much better place for that than in the kernel.

This patch also requires that /sys be mounted. How does that work for code operating early in the boot process or in a chroot environment (where an incapable uid=0 account being able to read/write /sys & /proc files can do more than a little damage)?

None of this touches on the fact that most utility applications that will support capabilities "the right way"(TM), will need the #define's at compile time for each of the capabilities they require (so they can pepper critical regions with cap_set_flag()/cap_set_proc() code.

When I mentioned this last time, you said you felt this feature was more aimed at admin applications like {get,set,pam_}cap. This is fine, but none of these admin applications 'use' capabilities, they just make them available/visible for other utility applications to use - which gets us back to my point; the utility apps can't use them (properly) without having compiled-in support to use them appropriately, which requires the #define's at compile time or an appropriate vintage of sys/capability.h which comes with an appropriately modern version of libcap. So, practically speaking all the capabilities the applications on a system should need should be present in the libcap on the system.

All that being said, the friendliness factor of this is somewhat undeniable, and so I can see why folk might want it in the kernel anyway. If so, would it possible to move this code into security/capability.c and not in the main kernel per-se - protected with a configuration option? If it does appear in the kernel, we'll obviously add your libcap changes too. If it doesn't, then perhaps we can meet your needs with a slight modification to your libcap patch to read the capabilities from an optional /etc/XXX file - and make text visibility of 'late breaking' capabilities something that the admin can tweak as needed?

Quoted 10 lines

All that being said, the friendliness factor of this is somewhat undeniable, and so I can see why folk might want it in the kernel anyway. If so, would it possible to move this code into security/capability.c and not in the main kernel per-se - protected with a configuration option? If it does appear in the kernel, we'll obviously add your libcap changes too. If it doesn't, then perhaps we can meet your needs with a slight modification to your libcap patch to read the capabilities from an optional /etc/XXX file - and make text visibility of 'late breaking' capabilities something that the admin can tweak as needed?

I think optional configuration file is not a good idea. It can make unneeded confusion.

If necessary, I'll move this features into security/capability.c and add a Kconfig option to select it.

do
echo "$x --> cat $x"
done

Quoted 11 lines

Quoted 10 lines

All that being said, the friendliness factor of this is somewhat undeniable, and so I can see why folk might want it in the kernel anyway. If so, would it possible to move this code into security/capability.c and not in the main kernel per-se - protected with a configuration option? If it does appear in the kernel, we'll obviously add your libcap changes too. If it doesn't, then perhaps we can meet your needs with a slight modification to your libcap patch to read the capabilities from an optional /etc/XXX file - and make text visibility of 'late breaking' capabilities something that the admin can tweak as needed?

Quoted 5 lines

I think optional configuration file is not a good idea. It can make unneeded confusion.

If necessary, I'll move this features into security/capability.c and add a Kconfig option to select it.

The following patch enables to export the list of capabilities supported on the running kernel, under /sys/kernel/capability .

Changelog from the previous version:
- Implementation is moved into security/capability.c from kernel/capability.c
- A Kconfig option SECURITY_CAPABILITIES_EXPORT is added to tuen on/off this feature.

[kaigai@saba ~]$ for x in /sys/kernel/capability/*

Quoted 3 lines

do
echo "$x --> cat $x"
done

/sys/kernel/capability/cap_audit_control --> 30
/sys/kernel/capability/cap_audit_write --> 29
- snip -
/sys/kernel/capability/cap_sys_time --> 25
/sys/kernel/capability/cap_sys_tty_config --> 26
/sys/kernel/capability/index --> 31
/sys/kernel/capability/version --> 0x19980330
[kaigai@saba ~]$

Thanks,

Signed-off-by KaiGai Kohei <[email protected]>

----

 scripts/mkcapnames.sh |   50 +++++++++++++++++++++++++++++++++++++++++++++++++
 security/Kconfig      |    9 ++++++++
 security/Makefile     |   11 ++++++++++
 security/capability.c |   49 ++++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 119 insertions(+), 0 deletions(-)

scripts/mkcapnames.sh +50 -0

index e69de29..262478e 100644
@@ -0,0 +1,50 @@
+#!/bin/sh
+
+#
+# generate a cap_names.h file from include/linux/capability.h
+#
+
+BASEDIR=`dirname $0`
+
+echo '#ifndef CAP_NAMES_H'
+echo '#define CAP_NAMES_H'
+echo
+echo '/*'
+echo ' * Do NOT edit this file directly.'
+echo ' * This file is generated from include/linux/capability.h automatically'
+echo ' */'
+echo
+echo '#ifndef SYSFS_CAPABILITY_ENTRY'
+echo '#error cap_names.h should be included from kernel/capability.c'
+echo '#else'
+
+echo 'SYSFS_CAPABILITY_ENTRY(version, "0x%08x\n", _LINUX_CAPABILITY_VERSION);'
+
+cat ${BASEDIR}/../include/linux/capability.h	\
+    | egrep '^#define CAP_[A-Z_]+[ 	]+[0-9]+$'	\
+    | awk 'BEGIN {
+            max_code = -1;
+        }
+        {
+            if ($3 > max_code)
+                max_code = $3;
+            printf("SYSFS_CAPABILITY_ENTRY(%s, \"%%u\\n\", %s);\n", tolower($2), $2);
+        }
+        END {
+            printf("SYSFS_CAPABILITY_ENTRY(index, \"%%u\\n\", %u);\n", max_code);
+        }'
+
+echo
+echo 'static struct attribute *capability_attrs[] = {'
+echo '        &version_attr.attr,'
+echo '        &index_attr.attr,'
+
+cat ${BASEDIR}/../include/linux/capability.h    \
+    | egrep '^#define CAP_[A-Z_]+[ 	]+[0-9]+$'   \
+    | awk '{ printf ("        &%s_attr.attr,\n", tolower($2)); }'
+
+echo '        NULL,'
+echo '};'
+
+echo '#endif	/* SYSFS_CAPABILITY_ENTRY */'
+echo '#endif	/* CAP_NAMES_H */'

security/Kconfig +9 -0

index 8086e61..e4d330c 100644
@@ -90,6 +90,15 @@ config SECURITY_FILE_CAPABILITIES
 
 	  If in doubt, answer N.
 
+config SECURITY_CAPABILITIES_EXPORT
+	bool "Exporting capabilities kernel supported"
+	depends on SECURITY_CAPABILITIES && SYSFS
+	help
+          This enables to export any capabilities which are supported
+	  in the running kernel.
+	
+	  If you are unsure how to answer this question, answer Y.
+
 config SECURITY_ROOTPLUG
 	bool "Root Plug Support"
 	depends on USB=y && SECURITY

security/Makefile +11 -0

index ef87df2..90a856d 100644
@@ -16,3 +16,14 @@ obj-$(CONFIG_SECURITY)			+= security.o dummy.o inode.o
 obj-$(CONFIG_SECURITY_SELINUX)		+= selinux/built-in.o
 obj-$(CONFIG_SECURITY_CAPABILITIES)	+= commoncap.o capability.o
 obj-$(CONFIG_SECURITY_ROOTPLUG)		+= commoncap.o root_plug.o
+
+ifeq ($(CONFIG_SECURITY_CAPABILITIES_EXPORT),y)
+# cap_names.h contains the code/name pair of capabilities.
+# It is generated using include/linux/capability.h automatically.
+$(obj)/capability.o: $(obj)/cap_names.h
+quiet_cmd_cap_names  = CAPS    $@
+      cmd_cap_names  = /bin/sh $(src)/../scripts/mkcapnames.sh > $@
+targets += cap_names.h
+$(obj)/cap_names.h: $(src)/../scripts/mkcapnames.sh $(src)/../include/linux/capability.h FORCE
+	$(call if_changed,cap_names)
+endif

security/capability.c +49 -0

index 9e99f36..06e0f0a 100644
@@ -20,6 +20,8 @@
 #include <linux/netlink.h>
 #include <linux/ptrace.h>
 #include <linux/moduleparam.h>
+#include <linux/kobject.h>
+#include <linux/sysfs.h>
 
 static struct security_operations capability_ops = {
 	.ptrace =			cap_ptrace,

@@ -58,6 +60,53 @@ static int secondary;
 static int capability_disable;
 module_param_named(disable, capability_disable, int, 0);
 
+#ifdef CONFIG_SECURITY_CAPABILITIES_EXPORT
+/*
+ * Export the list of capabilities on /sys/kernel/capability
+ */
+struct capability_attribute {
+	struct attribute attr;
+	ssize_t (*show)(struct kobject *kobj,
+			struct capability_attribute *attr,
+			char *buffer);
+	ssize_t (*store)(struct kobject *kobj,
+			 struct capability_attribute *attr,
+			 const char *buffer, size_t count);
+};
+
+#define SYSFS_CAPABILITY_ENTRY(_name, _fmt, ...)			\
+	static ssize_t _name##_show(struct kobject *kobj,		\
+				    struct capability_attribute *attr,	\
+				    char *buffer)			\
+	{                                                               \
+		return scnprintf(buffer, PAGE_SIZE, _fmt, __VA_ARGS__);	\
+	}								\
+	static struct capability_attribute _name##_attr = __ATTR_RO(_name)
+/*
+ * capability_attrs[] is generated automatically by scripts/mkcapnames.sh
+ * This script parses include/linux/capability.h
+ */
+#include "cap_names.h"
+
+static struct attribute_group capability_attr_group = {
+	.name = "capability",
+	.attrs = capability_attrs,
+};
+
+static int __init capability_export_names(void)
+{
+	int rc;
+
+	rc = sysfs_create_group(kernel_kobj, &capability_attr_group);
+	if (rc) {
+		printk(KERN_ERR "Unable to export capabilities\n");
+		return rc;
+	}
+	return 0;
+}
+__initcall(capability_export_names);
+#endif
+
 static int __init capability_init (void)
 {
 	if (capability_disable) {

Signature · 3 lines

-- 
OSS Platform Development Division, NEC
KaiGai Kohei <[email protected]>

Quoted 18 lines · Kohei KaiGai

Quoted 10 lines

Quoted 10 lines

All that being said, the friendliness factor of this is somewhat undeniable, and so I can see why folk might want it in the kernel anyway. If so, would it possible to move this code into security/capability.c and not in the main kernel per-se - protected with a configuration option? If it does appear in the kernel, we'll obviously add your libcap changes too. If it doesn't, then perhaps we can meet your needs with a slight modification to your libcap patch to read the capabilities from an optional /etc/XXX file - and make text visibility of 'late breaking' capabilities something that the admin can tweak as needed?

Quoted 5 lines

I think optional configuration file is not a good idea. It can make unneeded confusion.

If necessary, I'll move this features into security/capability.c and add a Kconfig option to select it.

The following patch enables to export the list of capabilities supported on the running kernel, under /sys/kernel/capability .

Quoted 3 lines

Changelog from the previous version:
- Implementation is moved into security/capability.c from kernel/capability.c
- A Kconfig option SECURITY_CAPABILITIES_EXPORT is added to tuen on/off this feature.

can you explain one more time exactly what this lets you do that you absolutely can't do with the current api?

I for one don't really object even if it is "duplicated" since it is far easier to use, and I frequently have systems where kernel and userspace are out of sync so /usr/include/sys/capabilities is worthless... Though I'm a little worried that b/scripts/mkcapnames.sh is the kind of thing that'll eventually break, but I suppose that's my fault for objecting two duplicated list of capability definitions :)

-serge

Quoted 188 lines

[kaigai@saba ~]$ for x in /sys/kernel/capability/*

Quoted 3 lines

do
echo "$x --> cat $x"
done

/sys/kernel/capability/cap_audit_control --> 30
/sys/kernel/capability/cap_audit_write --> 29
- snip -
/sys/kernel/capability/cap_sys_time --> 25
/sys/kernel/capability/cap_sys_tty_config --> 26
/sys/kernel/capability/index --> 31
/sys/kernel/capability/version --> 0x19980330
[kaigai@saba ~]$

Thanks,

Signed-off-by KaiGai Kohei <[email protected]>

----

 scripts/mkcapnames.sh |   50 +++++++++++++++++++++++++++++++++++++++++++++++++
 security/Kconfig      |    9 ++++++++
 security/Makefile     |   11 ++++++++++
 security/capability.c |   49 ++++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 119 insertions(+), 0 deletions(-)

scripts/mkcapnames.sh +50 -0

index e69de29..262478e 100644
@@ -0,0 +1,50 @@
+#!/bin/sh
+
+#
+# generate a cap_names.h file from include/linux/capability.h
+#
+
+BASEDIR=`dirname $0`
+
+echo '#ifndef CAP_NAMES_H'
+echo '#define CAP_NAMES_H'
+echo
+echo '/*'
+echo ' * Do NOT edit this file directly.'
+echo ' * This file is generated from include/linux/capability.h automatically'
+echo ' */'
+echo
+echo '#ifndef SYSFS_CAPABILITY_ENTRY'
+echo '#error cap_names.h should be included from kernel/capability.c'
+echo '#else'
+
+echo 'SYSFS_CAPABILITY_ENTRY(version, "0x%08x\n", _LINUX_CAPABILITY_VERSION);'
+
+cat ${BASEDIR}/../include/linux/capability.h	\
+    | egrep '^#define CAP_[A-Z_]+[ 	]+[0-9]+$'	\
+    | awk 'BEGIN {
+            max_code = -1;
+        }
+        {
+            if ($3 > max_code)
+                max_code = $3;
+            printf("SYSFS_CAPABILITY_ENTRY(%s, \"%%u\\n\", %s);\n", tolower($2), $2);
+        }
+        END {
+            printf("SYSFS_CAPABILITY_ENTRY(index, \"%%u\\n\", %u);\n", max_code);
+        }'
+
+echo
+echo 'static struct attribute *capability_attrs[] = {'
+echo '        &version_attr.attr,'
+echo '        &index_attr.attr,'
+
+cat ${BASEDIR}/../include/linux/capability.h    \
+    | egrep '^#define CAP_[A-Z_]+[ 	]+[0-9]+$'   \
+    | awk '{ printf ("        &%s_attr.attr,\n", tolower($2)); }'
+
+echo '        NULL,'
+echo '};'
+
+echo '#endif	/* SYSFS_CAPABILITY_ENTRY */'
+echo '#endif	/* CAP_NAMES_H */'

security/Kconfig +9 -0

index 8086e61..e4d330c 100644
@@ -90,6 +90,15 @@ config SECURITY_FILE_CAPABILITIES
 
 	  If in doubt, answer N.
 
+config SECURITY_CAPABILITIES_EXPORT
+	bool "Exporting capabilities kernel supported"
+	depends on SECURITY_CAPABILITIES && SYSFS
+	help
+          This enables to export any capabilities which are supported
+	  in the running kernel.
+	
+	  If you are unsure how to answer this question, answer Y.
+
 config SECURITY_ROOTPLUG
 	bool "Root Plug Support"
 	depends on USB=y && SECURITY

security/Makefile +11 -0

index ef87df2..90a856d 100644
@@ -16,3 +16,14 @@ obj-$(CONFIG_SECURITY)			+= security.o dummy.o inode.o
 obj-$(CONFIG_SECURITY_SELINUX)		+= selinux/built-in.o
 obj-$(CONFIG_SECURITY_CAPABILITIES)	+= commoncap.o capability.o
 obj-$(CONFIG_SECURITY_ROOTPLUG)		+= commoncap.o root_plug.o
+
+ifeq ($(CONFIG_SECURITY_CAPABILITIES_EXPORT),y)
+# cap_names.h contains the code/name pair of capabilities.
+# It is generated using include/linux/capability.h automatically.
+$(obj)/capability.o: $(obj)/cap_names.h
+quiet_cmd_cap_names  = CAPS    $@
+      cmd_cap_names  = /bin/sh $(src)/../scripts/mkcapnames.sh > $@
+targets += cap_names.h
+$(obj)/cap_names.h: $(src)/../scripts/mkcapnames.sh $(src)/../include/linux/capability.h FORCE
+	$(call if_changed,cap_names)
+endif

security/capability.c +49 -0

index 9e99f36..06e0f0a 100644
@@ -20,6 +20,8 @@
 #include <linux/netlink.h>
 #include <linux/ptrace.h>
 #include <linux/moduleparam.h>
+#include <linux/kobject.h>
+#include <linux/sysfs.h>
 
 static struct security_operations capability_ops = {
 	.ptrace =			cap_ptrace,

@@ -58,6 +60,53 @@ static int secondary;
 static int capability_disable;
 module_param_named(disable, capability_disable, int, 0);
 
+#ifdef CONFIG_SECURITY_CAPABILITIES_EXPORT
+/*
+ * Export the list of capabilities on /sys/kernel/capability
+ */
+struct capability_attribute {
+	struct attribute attr;
+	ssize_t (*show)(struct kobject *kobj,
+			struct capability_attribute *attr,
+			char *buffer);
+	ssize_t (*store)(struct kobject *kobj,
+			 struct capability_attribute *attr,
+			 const char *buffer, size_t count);
+};
+
+#define SYSFS_CAPABILITY_ENTRY(_name, _fmt, ...)			\
+	static ssize_t _name##_show(struct kobject *kobj,		\
+				    struct capability_attribute *attr,	\
+				    char *buffer)			\
+	{                                                               \
+		return scnprintf(buffer, PAGE_SIZE, _fmt, __VA_ARGS__);	\
+	}								\
+	static struct capability_attribute _name##_attr = __ATTR_RO(_name)
+/*
+ * capability_attrs[] is generated automatically by scripts/mkcapnames.sh
+ * This script parses include/linux/capability.h
+ */
+#include "cap_names.h"
+
+static struct attribute_group capability_attr_group = {
+	.name = "capability",
+	.attrs = capability_attrs,
+};
+
+static int __init capability_export_names(void)
+{
+	int rc;
+
+	rc = sysfs_create_group(kernel_kobj, &capability_attr_group);
+	if (rc) {
+		printk(KERN_ERR "Unable to export capabilities\n");
+		return rc;
+	}
+	return 0;
+}
+__initcall(capability_export_names);
+#endif
+
 static int __init capability_init (void)
 {
 	if (capability_disable) {

Signature · 3 lines

-- 
OSS Platform Development Division, NEC
KaiGai Kohei <[email protected]>

Quoted 26 lines · Serge E. Hallyn

Quoted 25 lines · Kohei KaiGai

Quoted 12 lines

Quoted 4 lines

All that being said, the friendliness factor of this is somewhat undeniable, and so I can see why folk might want it in the kernel anyway. If so, would it possible to move this code into security/capability.c and not in the main kernel per-se - protected

Quoted 8 lines

with
a configuration option? If it does appear in the kernel, we'll obviously
add your libcap changes too. If it doesn't, then perhaps we can meet your needs with a slight modification to your libcap patch to read the capabilities from an optional /etc/XXX file - and make text visibility of 'late breaking' capabilities something that the admin can tweak as needed?

Quoted 5 lines

I think optional configuration file is not a good idea. It can make unneeded confusion.

If necessary, I'll move this features into security/capability.c and add a Kconfig option to select it.

The following patch enables to export the list of capabilities supported on the running kernel, under /sys/kernel/capability .

Changelog from the previous version:
- Implementation is moved into security/capability.c from kernel/capability.c
- A Kconfig option SECURITY_CAPABILITIES_EXPORT is added to tuen on/off this feature.

Quoted 2 lines

can you explain one more time exactly what this lets you do that you absolutely can't do with the current api?

Please consider the following situation:

A user intend to run an application which use a new capability supported at new kernel without synced libcap. In this case, the application cannot work well, because libcap prevent to use new capability.

When the kernel and libcap are not synced, the header files provided by libcap pacakge is not reliable. Typically, kernel developer sometimes faces such a situation. :)

This feature can fill the gap with providing a new interface to collect capabilities supported by the running kernel collectly.

Quoted 6 lines

I for one don't really object even if it is "duplicated" since it is far easier to use, and I frequently have systems where kernel and userspace are out of sync so /usr/include/sys/capabilities is worthless... Though I'm a little worried that b/scripts/mkcapnames.sh is the kind of thing that'll eventually break, but I suppose that's my fault for objecting two duplicated list of capability definitions :)

Are you worried about "mkcapnames.sh" get broken in the future version?

If so, we can add a code to check whether this script works correctly, or not

like:
-- at security/capability.c

  #include <linux/capability.h>
           :

#if CAP_LAST_CAP != ARRAY_SIZE(capability_attrs) #error "mkcapnames.sh added fewer or more entries than expected!" #endif

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

KaiGai,

Thanks for trying to accommodate me :-)

Kohei KaiGai wrote:
| In addition, Andrew suggested me to export these translation by symlinks | to reduce the number of invocation of system call.

Yes, I wanted to make use of readlink() instead of open()/read()/close() to access each unknown capability.

| However, current sysfs interface does not allows to create symlinks with | invalid indication.

:-(

| Thus, this patch exports them as regular files.

What about using symlinks for the name files and text content for the numeric ones? You could even drop the names/ and codes/ subdirectories too:

$ cat /sys/kernel/capability/20
cap_sys_pacct
$ ls -l /sys/kernel/capability/cap_mknod
lr--r--r--  1 root root 64 Feb  8 08:26 cap_mknod -> 27
$ cat /sys/kernel/capability/names/cap_mknod
cap_mknod

[kaigai@saba ~]$ ls -R /sys/kernel/capability/
/sys/kernel/capability/:
codes names version

/sys/kernel/capability/codes:

0  10  12  14  16  18  2   21  23  25  27  29  30  32  4  6  8
1  11  13  15  17  19  20  22  24  26  28  3   31  33  5  7  9

/sys/kernel/capability/names:

cap_audit_control    cap_kill              cap_net_raw     cap_sys_nice
cap_audit_write      cap_lease             cap_setfcap     cap_sys_pacct
cap_chown            cap_linux_immutable   cap_setgid      cap_sys_ptrace
cap_dac_override     cap_mac_admin         cap_setpcap     cap_sys_rawio
cap_dac_read_search  cap_mac_override      cap_setuid      cap_sys_resource
cap_fowner           cap_mknod             cap_sys_admin   cap_sys_time
cap_fsetid           cap_net_admin         cap_sys_boot    cap_sys_tty_config
cap_ipc_lock         cap_net_bind_service  cap_sys_chroot
cap_ipc_owner        cap_net_broadcast     cap_sys_module

[kaigai@saba ~]$ cat /sys/kernel/capability/codes/20 cap_sys_pacct
[kaigai@saba ~]$ cat /sys/kernel/capability/names/cap_mknod 27
[kaigai@saba ~]$
--------------------------------------------------------
Any comment please.

Quoted 18 lines · Kohei KaiGai

[kaigai@saba ~]$ ls -R /sys/kernel/capability/
/sys/kernel/capability/:
codes names version

/sys/kernel/capability/codes:

0  10  12  14  16  18  2   21  23  25  27  29  30  32  4  6  8
1  11  13  15  17  19  20  22  24  26  28  3   31  33  5  7  9

/sys/kernel/capability/names:

cap_audit_control    cap_kill              cap_net_raw     cap_sys_nice
cap_audit_write      cap_lease             cap_setfcap     cap_sys_pacct
cap_chown            cap_linux_immutable   cap_setgid      cap_sys_ptrace
cap_dac_override     cap_mac_admin         cap_setpcap     cap_sys_rawio
cap_dac_read_search  cap_mac_override      cap_setuid      cap_sys_resource
cap_fowner           cap_mknod             cap_sys_admin   cap_sys_time
cap_fsetid           cap_net_admin         cap_sys_boot    cap_sys_tty_config
cap_ipc_lock         cap_net_bind_service  cap_sys_chroot
cap_ipc_owner        cap_net_broadcast     cap_sys_module

Quoted 7 lines

[kaigai@saba ~]$ cat /sys/kernel/capability/codes/20 cap_sys_pacct
[kaigai@saba ~]$ cat /sys/kernel/capability/names/cap_mknod 27
[kaigai@saba ~]$
--------------------------------------------------------
Any comment please.

You don't like 1 (one) /proc/capabilities, why?

Quoted 29 lines · Alexey Dobriyan

Quoted 27 lines · Kohei KaiGai

[kaigai@saba ~]$ ls -R /sys/kernel/capability/
/sys/kernel/capability/:
codes names version

/sys/kernel/capability/codes:

0  10  12  14  16  18  2   21  23  25  27  29  30  32  4  6  8
1  11  13  15  17  19  20  22  24  26  28  3   31  33  5  7  9

/sys/kernel/capability/names:

cap_audit_control    cap_kill              cap_net_raw     cap_sys_nice
cap_audit_write      cap_lease             cap_setfcap     cap_sys_pacct
cap_chown            cap_linux_immutable   cap_setgid      cap_sys_ptrace
cap_dac_override     cap_mac_admin         cap_setpcap     cap_sys_rawio
cap_dac_read_search  cap_mac_override      cap_setuid      
cap_sys_resource
cap_fowner           cap_mknod             cap_sys_admin   cap_sys_time
cap_fsetid           cap_net_admin         cap_sys_boot    
cap_sys_tty_config
cap_ipc_lock         cap_net_bind_service  cap_sys_chroot
cap_ipc_owner        cap_net_broadcast     cap_sys_module

[kaigai@saba ~]$ cat /sys/kernel/capability/codes/20 cap_sys_pacct
[kaigai@saba ~]$ cat /sys/kernel/capability/names/cap_mknod 27
[kaigai@saba ~]$
--------------------------------------------------------
Any comment please.

Quoted 1 line

You don't like 1 (one) /proc/capabilities, why?

I have no preference whether a single /proc/capabilities, or the current approach.
However, this idea requires a bit more cost to lookup a capability not sequencially.

Quoted 27 lines · Kohei KaiGai

Quoted 26 lines · Alexey Dobriyan

Quoted 25 lines · Kohei KaiGai

[kaigai@saba ~]$ ls -R /sys/kernel/capability/
/sys/kernel/capability/:
codes names version

/sys/kernel/capability/codes:

0  10  12  14  16  18  2   21  23  25  27  29  30  32  4  6  8
1  11  13  15  17  19  20  22  24  26  28  3   31  33  5  7  9

/sys/kernel/capability/names:

cap_audit_control    cap_kill              cap_net_raw     cap_sys_nice
cap_audit_write      cap_lease             cap_setfcap     cap_sys_pacct
cap_chown            cap_linux_immutable   cap_setgid      cap_sys_ptrace
cap_dac_override     cap_mac_admin         cap_setpcap     cap_sys_rawio
cap_dac_read_search  cap_mac_override      cap_setuid      cap_sys_resource
cap_fowner           cap_mknod             cap_sys_admin   cap_sys_time
cap_fsetid           cap_net_admin         cap_sys_boot    cap_sys_tty_config
cap_ipc_lock         cap_net_bind_service  cap_sys_chroot
cap_ipc_owner        cap_net_broadcast     cap_sys_module

[kaigai@saba ~]$ cat /sys/kernel/capability/codes/20 cap_sys_pacct
[kaigai@saba ~]$ cat /sys/kernel/capability/names/cap_mknod 27
[kaigai@saba ~]$
--------------------------------------------------------
Any comment please.

Quoted 3 lines

Quoted 1 line

You don't like 1 (one) /proc/capabilities, why?

I have no preference whether a single /proc/capabilities, or the current approach. However, this idea requires a bit more cost to lookup a capability not sequencially.

And I'm sure far less memory wasted at runtime.

Also, adding config option for one file/directory seems ridiculous to me. And changelog completely fails to mention why it is useful to lookup capabilities by name and number -- CAP_SYS_* numbers are part of ABI, they won't change.

This patch enables to export code/name pair of capabilities supported on the running kernel, under the /sys/kernel/capability . We can apply it onto the latest Linus's git tree.

Changes from the previous version:
- I added "names/" ans "codes/" directories, and we can use them to lookup capability code or name non-sequentially.
In the previous version, we had to scan whole of entries to lookup capability name by its code.
(required by Andrew Morgan)
- I added an assertion when "mkcapname.sh" works incorrectly. (required by Serge E.Hallyn)

In addition, Andrew suggested me to export these translation by symlinks to reduce the number of invocation of system call.
However, current sysfs interface does not allows to create symlinks with invalid indication.
Thus, this patch exports them as regular files.

--------------------------------------------------------
[kaigai@saba ~]$ ls -R /sys/kernel/capability/
/sys/kernel/capability/:
codes names version

/sys/kernel/capability/codes:

0  10  12  14  16  18  2   21  23  25  27  29  30  32  4  6  8
1  11  13  15  17  19  20  22  24  26  28  3   31  33  5  7  9

/sys/kernel/capability/names:

cap_audit_control    cap_kill              cap_net_raw     cap_sys_nice
cap_audit_write      cap_lease             cap_setfcap     cap_sys_pacct
cap_chown            cap_linux_immutable   cap_setgid      cap_sys_ptrace
cap_dac_override     cap_mac_admin         cap_setpcap     cap_sys_rawio
cap_dac_read_search  cap_mac_override      cap_setuid      cap_sys_resource
cap_fowner           cap_mknod             cap_sys_admin   cap_sys_time
cap_fsetid           cap_net_admin         cap_sys_boot    cap_sys_tty_config
cap_ipc_lock         cap_net_bind_service  cap_sys_chroot
cap_ipc_owner        cap_net_broadcast     cap_sys_module

[kaigai@saba ~]$ cat /sys/kernel/capability/codes/20 cap_sys_pacct
[kaigai@saba ~]$ cat /sys/kernel/capability/names/cap_mknod 27
[kaigai@saba ~]$
--------------------------------------------------------
Any comment please.

Thanks,

Signed-off-by KaiGai Kohei <[email protected]>

----

 scripts/mkcapnames.sh |   44 +++++++++++++++++++
 security/Kconfig      |    9 ++++
 security/Makefile     |   11 +++++
 security/capability.c |  115 +++++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 179 insertions(+), 0 deletions(-)

scripts/mkcapnames.sh +44 -0

index e69de29..9e7290f 100644
@@ -0,0 +1,44 @@
+#!/bin/sh
+
+#
+# generate a cap_names.h file from include/linux/capability.h
+#
+
+CAPHEAD="`dirname $0`/../include/linux/capability.h"
+REGEXP='^#define CAP_[A-Z_]+[ 	]+[0-9]+$'
+NUMCAP=`cat "$CAPHEAD" | egrep -c "$REGEXP"`
+
+echo '#ifndef CAP_NAMES_H'
+echo '#define CAP_NAMES_H'
+echo
+echo '/*'
+echo ' * Do NOT edit this file directly.'
+echo ' * This file is generated from include/linux/capability.h automatically'
+echo ' */'
+echo
+echo '#if !defined(SYSFS_CAP_NAME_ENTRY) || !defined(SYSFS_CAP_CODE_ENTRY)'
+echo '#error cap_names.h should be included from security/capability.c'
+echo '#else'
+echo "#if $NUMCAP != CAP_LAST_CAP + 1"
+echo '#error mkcapnames.sh cannot collect capabilities correctly'
+echo '#else'
+cat "$CAPHEAD" | egrep "$REGEXP" \
+    | awk '{ printf("SYSFS_CAP_NAME_ENTRY(%s,%s);\n", tolower($2), $2); }'
+echo
+echo 'static struct attribute *capability_name_attrs[] = {'
+cat "$CAPHEAD" | egrep "$REGEXP" \
+    | awk '{ printf("\t&%s_name_attr.attr,\n", tolower($2)); } END { print "\tNULL," }'
+echo '};'
+
+echo
+cat "$CAPHEAD" | egrep "$REGEXP" \
+    | awk '{ printf("SYSFS_CAP_CODE_ENTRY(%s,%s);\n", tolower($2), $2); }'
+echo
+echo 'static struct attribute *capability_code_attrs[] = {'
+cat "$CAPHEAD" | egrep "$REGEXP" \
+    | awk '{ printf("\t&%s_code_attr.attr,\n", tolower($2)); } END { print "\tNULL," }'
+echo '};'
+
+echo '#endif'
+echo '#endif'
+echo '#endif'

security/Kconfig +0 -0

index 25ffe1b..b79e830 100644

From 54c70ca7671750fe8986451fae91d42107d0ca90 Mon Sep 17 00:00:00 2001

security/Kconfig config SECURITY_FILE_CAPABILITIES · line 96

Quoted 11 lines · Kohei KaiGai

security/Kconfig +3 -0

index 25ffe1b..b79e830 100644
@@ -91,6 +91,15 @@ config SECURITY_FILE_CAPABILITIES
 
 	  If in doubt, answer N.
 
+config SECURITY_CAPABILITIES_EXPORT
+	bool "Exporting capabilities kernel supported"
+	depends on SECURITY_CAPABILITIES && SYSFS

Oh no, we're being bit by this again... When SECURITY=n, capabilities are compiled in but SECURITY_CAPABILITIES=n.

Months ago I floated the following patch so we'd have a CONFIG variable to let us know whether commoncap is compiled in. You might want to use this and depend on CONFIG_COMMONCAP? (Though really I personally don't think you need your own config variable for this)

Other than that, this tested fine for me.

thanks,
-serge

Quoted 1 line

From 54c70ca7671750fe8986451fae91d42107d0ca90 Mon Sep 17 00:00:00 2001

From: Serge E. Hallyn <[email protected]>
Date: Fri, 28 Sep 2007 10:33:33 -0500
Subject: [PATCH 1/2] capabilities: define CONFIG_COMMONCAP

currently the compilation of commoncap.c is determined through Makefile logic. So there is no single CONFIG variable which can be relied upon to know whether it will be compiled.

Define CONFIG_COMMONCAP to be true when lsm is not compiled in, or when the capability or rootplug modules are compiled. These are the cases when commoncap is currently compiled. Use this variable in security/Makefile to determine commoncap.c's compilation.

Apart from being a logic cleanup, this is needed by the upcoming cap_bset patch so that prctl can know whether PR_SET_BSET should be allowed.

Signed-off-by Serge E. Hallyn <[email protected]>

---
 security/Kconfig  |    4 ++++
 security/Makefile |    9 +++------
 2 files changed, 7 insertions(+), 6 deletions(-)

security/Kconfig +4 -0

index 8086e61..02b33fa 100644
@@ -103,6 +103,10 @@ config SECURITY_ROOTPLUG
 
 	  If you are unsure how to answer this question, answer N.
 
+config COMMONCAP
+	bool
+	default !SECURITY || SECURITY_CAPABILITIES || SECURITY_ROOTPLUG
+
 source security/selinux/Kconfig
 
 endmenu

security/Makefile +3 -6

index ef87df2..7cccc81 100644
@@ -5,14 +5,11 @@
 obj-$(CONFIG_KEYS)			+= keys/
 subdir-$(CONFIG_SECURITY_SELINUX)	+= selinux
 
-# if we don't select a security model, use the default capabilities
-ifneq ($(CONFIG_SECURITY),y)
-obj-y		+= commoncap.o
-endif
+obj-$(CONFIG_COMMONCAP)			+= commoncap.o
 
 # Object file lists
 obj-$(CONFIG_SECURITY)			+= security.o dummy.o inode.o
 # Must precede capability.o in order to stack properly.
 obj-$(CONFIG_SECURITY_SELINUX)		+= selinux/built-in.o
-obj-$(CONFIG_SECURITY_CAPABILITIES)	+= commoncap.o capability.o
-obj-$(CONFIG_SECURITY_ROOTPLUG)		+= commoncap.o root_plug.o
+obj-$(CONFIG_SECURITY_CAPABILITIES)	+= capability.o
+obj-$(CONFIG_SECURITY_ROOTPLUG)		+= root_plug.o

security/commoncap.c +23 -0

+static int __init capability_export_names(void)
+{
+	/* make /sys/kernel/capability */
+	capability_kobj = kobject_create_and_add("capability", kernel_kobj);
+	if (!capability_kobj)
+		goto error0;
+
+	/* make /sys/kernel/capability/names */
+	if (sysfs_create_group(capability_kobj,
+			       &capability_name_attr_group))
+		goto error1;
+
+	/* make /sys/kernel/capability/codes */
+	if (sysfs_create_group(capability_kobj,
+			       &capability_code_attr_group))
+		goto error2;
+
+	if (sysfs_create_file(capability_kobj,
+			      &cap_version_attr.attr))
+		goto error3;
+
+	return 0;
+

(quoted diff) +2 -0

+}
+__initcall(capability_export_names);

Review

Quoted 6 lines

(quoted diff) +6 -0

+error1:
+	kobject_put(capability_kobj);
+error0:
+	printk(KERN_ERR "Unable to export capabilities\n");
+
+	return 0;

Should return -EFXXX ..

Li Zefan wrote:
- snip -

Quoted 8 lines

security/commoncap.c int cap_vm_enough_memory(struct mm_struct *mm, long pages)

Quoted 6 lines

security/commoncap.c +6 -0

+error1:
+	kobject_put(capability_kobj);
+error0:
+	printk(KERN_ERR "Unable to export capabilities\n");
+
+	return 0;

Should return -EFXXX ..

Oops,
I fixed it as follows. Thanks for your pointed out.

--------
This patch enables to export code/name of capabilities supported on the running kernel.

A newer kernel sometimes adds new capabilities, like CAP_MAC_ADMIN at 2.6.25. However, we have no interface to disclose what capabilities are supported on this kernel. Thus, we have to maintain libcap version in appropriate one synchronously.

This patch enables libcap to collect the list of capabilities on run time, and provide them for users.
It helps to improve portability of library.

It exports these information as regular files under /sys/kernel/capability. The numeric node exports its name, the symbolic node exports its code.

Please consider to put this patch on the queue of 2.6.25.

Thanks,
===================================================
[kaigai@saba ~]$ ls -R /sys/kernel/capability/
/sys/kernel/capability/:
codes names version

/sys/kernel/capability/codes:

0  10  12  14  16  18  2   21  23  25  27  29  30  32  4  6  8
1  11  13  15  17  19  20  22  24  26  28  3   31  33  5  7  9

/sys/kernel/capability/names:

cap_audit_control    cap_kill              cap_net_raw     cap_sys_nice
cap_audit_write      cap_lease             cap_setfcap     cap_sys_pacct
cap_chown            cap_linux_immutable   cap_setgid      cap_sys_ptrace
cap_dac_override     cap_mac_admin         cap_setpcap     cap_sys_rawio
cap_dac_read_search  cap_mac_override      cap_setuid      cap_sys_resource
cap_fowner           cap_mknod             cap_sys_admin   cap_sys_time
cap_fsetid           cap_net_admin         cap_sys_boot    cap_sys_tty_config
cap_ipc_lock         cap_net_bind_service  cap_sys_chroot
cap_ipc_owner        cap_net_broadcast     cap_sys_module

[kaigai@saba ~]$ cat /sys/kernel/capability/version 0x20071026
[kaigai@saba ~]$ cat /sys/kernel/capability/codes/30 cap_audit_control
[kaigai@saba ~]$ cat /sys/kernel/capability/names/cap_sys_pacct 20
[kaigai@saba ~]$
===================================================

Signed-off-by KaiGai Kohei <[email protected]>

--

 scripts/mkcapnames.sh |   44 ++++++++++++++++++
 security/Makefile     |    9 ++++
 security/commoncap.c  |  118 +++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 171 insertions(+), 0 deletions(-)

scripts/mkcapnames.sh +44 -0

index e69de29..5d36d52 100644
@@ -0,0 +1,44 @@
+#!/bin/sh
+
+#
+# generate a cap_names.h file from include/linux/capability.h
+#
+
+CAPHEAD="`dirname $0`/../include/linux/capability.h"
+REGEXP='^#define CAP_[A-Z_]+[ 	]+[0-9]+$'
+NUMCAP=`cat "$CAPHEAD" | egrep -c "$REGEXP"`
+
+echo '#ifndef CAP_NAMES_H'
+echo '#define CAP_NAMES_H'
+echo
+echo '/*'
+echo ' * Do NOT edit this file directly.'
+echo ' * This file is generated from include/linux/capability.h automatically'
+echo ' */'
+echo
+echo '#if !defined(SYSFS_CAP_NAME_ENTRY) || !defined(SYSFS_CAP_CODE_ENTRY)'
+echo '#error cap_names.h should be included from security/capability.c'
+echo '#else'
+echo "#if $NUMCAP != CAP_LAST_CAP + 1"
+echo '#error mkcapnames.sh cannot collect capabilities correctly'
+echo '#else'
+cat "$CAPHEAD" | egrep "$REGEXP" \
+    | awk '{ printf("SYSFS_CAP_NAME_ENTRY(%s,%s);\n", tolower($2), $2); }'
+echo
+echo 'static struct attribute *capability_name_attrs[] = {'
+cat "$CAPHEAD" | egrep "$REGEXP" \
+    | awk '{ printf("\t&%s_name_attr.attr,\n", tolower($2)); } END { print "\tNULL," }'
+echo '};'
+
+echo
+cat "$CAPHEAD" | egrep "$REGEXP" \
+    | awk '{ printf("SYSFS_CAP_CODE_ENTRY(%s,%s);\n", tolower($2), $2); }'
+echo
+echo 'static struct attribute *capability_code_attrs[] = {'
+cat "$CAPHEAD" | egrep "$REGEXP" \
+    | awk '{ printf("\t&%s_code_attr.attr,\n", tolower($2)); } END { print "\tNULL," }'
+echo '};'
+
+echo '#endif'
+echo '#endif'
+echo '#endif'

security/Makefile +9 -0

index 9e8b025..c1ffc00 100644
@@ -18,3 +18,12 @@ obj-$(CONFIG_SECURITY_SELINUX)		+= selinux/built-in.o
 obj-$(CONFIG_SECURITY_SMACK)		+= commoncap.o smack/built-in.o
 obj-$(CONFIG_SECURITY_CAPABILITIES)	+= commoncap.o capability.o
 obj-$(CONFIG_SECURITY_ROOTPLUG)		+= commoncap.o root_plug.o
+
+# cap_names.h contains the code/name pair of capabilities.
+# It is generated using include/linux/capability.h automatically.
+$(obj)/commoncap.o: $(obj)/cap_names.h
+quiet_cmd_cap_names  = CAPS    $@
+	cmd_cap_names  = /bin/sh $(src)/../scripts/mkcapnames.sh > $@
+targets += cap_names.h
+$(obj)/cap_names.h: $(src)/../scripts/mkcapnames.sh $(src)/../include/linux/capability.h FORCE
+	$(call if_changed,cap_names)

security/commoncap.c +118 -0

index 5aba826..9e5665e 100644
@@ -24,6 +24,8 @@
 #include <linux/hugetlb.h>
 #include <linux/mount.h>
 #include <linux/sched.h>
+#include <linux/kobject.h>
+#include <linux/sysfs.h>
 
 /* Global security state */
 

@@ -637,3 +639,119 @@ int cap_vm_enough_memory(struct mm_struct *mm, long pages)
 	return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
 
+/*
+ * Export the list of capabilities on /sys/kernel/capability
+ */
+static struct kobject *capability_kobj;
+
+struct capability_attribute {
+	struct attribute attr;
+	ssize_t (*show)(struct kobject *kobj,
+			struct capability_attribute *attr,
+			char *buffer);
+	ssize_t (*store)(struct kobject *kobj,
+			 struct capability_attribute *attr,
+			 const char *buffer, size_t count);
+	union {
+		int code;
+		char *name;
+	} c;
+};
+
+static ssize_t capability_name_show(struct kobject *kobj,
+				    struct capability_attribute *attr,
+				    char *buffer)
+{
+	return scnprintf(buffer, PAGE_SIZE, "%d\n", attr->c.code);
+}
+
+static ssize_t capability_code_show(struct kobject *kobj,
+				    struct capability_attribute *attr,
+				    char *buffer)
+{
+	return scnprintf(buffer, PAGE_SIZE, "%s\n", attr->c.name);
+}
+
+static ssize_t capability_version_show(struct kobject *kobj,
+				       struct capability_attribute *attr,
+				       char *buffer)
+{
+	return scnprintf(buffer, PAGE_SIZE, "0x%08x\n",
+			 _LINUX_CAPABILITY_VERSION);
+}
+
+#define SYSFS_CAP_NAME_ENTRY(_name,_code)	\
+	static struct capability_attribute _name##_name_attr = {	\
+		.attr = { .name = __stringify(_name), .mode = 0444 },	\
+		.show = capability_name_show,				\
+		.c.code = (_code),					\
+	}
+
+#define SYSFS_CAP_CODE_ENTRY(_name,_code)				\
+	static struct capability_attribute _name##_code_attr = {	\
+		.attr = { .name = __stringify(_code), .mode = 0444 },   \
+		.show = capability_code_show,				\
+		.c.name = __stringify(_name),				\
+	}
+/*
+ * capability_attrs[] is generated automatically by scripts/mkcapnames.sh
+ * This script parses include/linux/capability.h
+ */
+#include "cap_names.h"
+
+static struct attribute_group capability_name_attr_group = {
+	.name = "names",
+	.attrs = capability_name_attrs,
+};
+
+static struct attribute_group capability_code_attr_group = {
+	.name = "codes",
+	.attrs = capability_code_attrs,
+};
+
+static struct capability_attribute cap_version_attr = {
+	.attr = { .name = "version", .mode = 0444 },
+	.show = capability_version_show,
+};
+
+static int __init capability_export_names(void)
+{
+	int rc = -ENOMEM;
+
+	/* make /sys/kernel/capability */
+	capability_kobj = kobject_create_and_add("capability", kernel_kobj);
+	if (!capability_kobj)
+		goto error0;
+
+	/* make /sys/kernel/capability/names */
+	rc = sysfs_create_group(capability_kobj,
+				&capability_name_attr_group);
+	if (rc)
+		goto error1;
+
+	/* make /sys/kernel/capability/codes */
+	rc = sysfs_create_group(capability_kobj,
+				&capability_code_attr_group);
+	if (rc)
+		goto error2;
+
+	/* make /sys/kernel/capability/version */
+	rc = sysfs_create_file(capability_kobj,
+			       &cap_version_attr.attr);
+	if (rc)
+		goto error3;
+
+	return 0;
+
+error3:
+	sysfs_remove_group(capability_kobj, &capability_code_attr_group);
+error2:
+	sysfs_remove_group(capability_kobj, &capability_name_attr_group);
+error1:
+	kobject_put(capability_kobj);
+error0:
+	printk(KERN_ERR "Unable to export capabilities\n");
+
+	return rc;
+}
+__initcall(capability_export_names);

Signature · 7 lines

-- 
OSS Platform Development Division, NEC
KaiGai Kohei <[email protected]>
-
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Quoted 30 lines · Kohei KaiGai

Li Zefan wrote:
- snip -

Quoted 8 lines

security/commoncap.c int cap_vm_enough_memory(struct mm_struct *mm, long pages)

Quoted 6 lines

security/commoncap.c +6 -0

+error1:
+	kobject_put(capability_kobj);
+error0:
+	printk(KERN_ERR "Unable to export capabilities\n");
+
+	return 0;

Should return -EFXXX ..

Oops,
I fixed it as follows. Thanks for your pointed out.

--------
This patch enables to export code/name of capabilities supported on the running kernel.

A newer kernel sometimes adds new capabilities, like CAP_MAC_ADMIN at 2.6.25. However, we have no interface to disclose what capabilities are supported on this kernel. Thus, we have to maintain libcap version in appropriate one synchronously.

This patch enables libcap to collect the list of capabilities on run time, and provide them for users.
It helps to improve portability of library.

It exports these information as regular files under /sys/kernel/capability. The numeric node exports its name, the symbolic node exports its code.

Quoted 1 line

Please consider to put this patch on the queue of 2.6.25.

Looks good, except don't you need to put the code in commoncap.c under a #ifdef SYSFS?

thanks,
-serge

Quoted 29 lines

Thanks,
===================================================
[kaigai@saba ~]$ ls -R /sys/kernel/capability/
/sys/kernel/capability/:
codes names version

/sys/kernel/capability/codes:

0  10  12  14  16  18  2   21  23  25  27  29  30  32  4  6  8
1  11  13  15  17  19  20  22  24  26  28  3   31  33  5  7  9

/sys/kernel/capability/names:

cap_audit_control    cap_kill              cap_net_raw     cap_sys_nice
cap_audit_write      cap_lease             cap_setfcap     cap_sys_pacct
cap_chown            cap_linux_immutable   cap_setgid      cap_sys_ptrace
cap_dac_override     cap_mac_admin         cap_setpcap     cap_sys_rawio
cap_dac_read_search  cap_mac_override      cap_setuid      cap_sys_resource
cap_fowner           cap_mknod             cap_sys_admin   cap_sys_time
cap_fsetid           cap_net_admin         cap_sys_boot    cap_sys_tty_config
cap_ipc_lock         cap_net_bind_service  cap_sys_chroot
cap_ipc_owner        cap_net_broadcast     cap_sys_module

[kaigai@saba ~]$ cat /sys/kernel/capability/version 0x20071026
[kaigai@saba ~]$ cat /sys/kernel/capability/codes/30 cap_audit_control
[kaigai@saba ~]$ cat /sys/kernel/capability/names/cap_sys_pacct 20
[kaigai@saba ~]$
===================================================

Quoted 13 lines · Serge E. Hallyn

Quoted 13 lines

--------
This patch enables to export code/name of capabilities supported on the running kernel.

A newer kernel sometimes adds new capabilities, like CAP_MAC_ADMIN at 2.6.25. However, we have no interface to disclose what capabilities are supported on this kernel. Thus, we have to maintain libcap version in appropriate one synchronously.

This patch enables libcap to collect the list of capabilities on run time, and provide them for users.
It helps to improve portability of library.

Quoted 6 lines

Quoted 4 lines

It exports these information as regular files under /sys/kernel/capability. The numeric node exports its name, the symbolic node exports its code.

Please consider to put this patch on the queue of 2.6.25.

Looks good, except don't you need to put the code in commoncap.c under a #ifdef SYSFS?

Quoted 19 lines

Quoted 19 lines

===================================================
[kaigai@saba ~]$ ls -R /sys/kernel/capability/
/sys/kernel/capability/:
codes names version

/sys/kernel/capability/codes:

0  10  12  14  16  18  2   21  23  25  27  29  30  32  4  6  8
1  11  13  15  17  19  20  22  24  26  28  3   31  33  5  7  9

/sys/kernel/capability/names:

cap_audit_control    cap_kill              cap_net_raw     cap_sys_nice
cap_audit_write      cap_lease             cap_setfcap     cap_sys_pacct
cap_chown            cap_linux_immutable   cap_setgid      cap_sys_ptrace
cap_dac_override     cap_mac_admin         cap_setpcap     cap_sys_rawio
cap_dac_read_search  cap_mac_override      cap_setuid      cap_sys_resource
cap_fowner           cap_mknod             cap_sys_admin   cap_sys_time
cap_fsetid           cap_net_admin         cap_sys_boot    cap_sys_tty_config
cap_ipc_lock         cap_net_bind_service  cap_sys_chroot
cap_ipc_owner        cap_net_broadcast     cap_sys_module

Quoted 8 lines

Quoted 8 lines

[kaigai@saba ~]$ cat /sys/kernel/capability/version 0x20071026
[kaigai@saba ~]$ cat /sys/kernel/capability/codes/30 cap_audit_control
[kaigai@saba ~]$ cat /sys/kernel/capability/names/cap_sys_pacct 20
[kaigai@saba ~]$
===================================================

As you are adding new sysfs entries, please also add the needed Documentation/ABI/ entries as well.

Also, this code can be cleaned up a lot by just using the basic kobject attributes, and not rolling your own types here.

Quoted 17 lines · Greg KH

Quoted 16 lines · Serge E. Hallyn

Quoted 16 lines

--------
This patch enables to export code/name of capabilities supported on the running kernel.

A newer kernel sometimes adds new capabilities, like CAP_MAC_ADMIN at 2.6.25. However, we have no interface to disclose what capabilities are supported on this kernel. Thus, we have to maintain libcap version in appropriate one synchronously.

This patch enables libcap to collect the list of capabilities on run time, and provide them for users.
It helps to improve portability of library.

It exports these information as regular files under /sys/kernel/capability. The numeric node exports its name, the symbolic node exports its code.

Quoted 3 lines

Quoted 3 lines

Quoted 1 line

Please consider to put this patch on the queue of 2.6.25.

Looks good, except don't you need to put the code in commoncap.c under a #ifdef SYSFS?

Fair enough.
I added the #ifdef - #endif block in this patch.

Quoted 29 lines

Quoted 28 lines

Quoted 28 lines

===================================================
[kaigai@saba ~]$ ls -R /sys/kernel/capability/
/sys/kernel/capability/:
codes names version

/sys/kernel/capability/codes:

0  10  12  14  16  18  2   21  23  25  27  29  30  32  4  6  8
1  11  13  15  17  19  20  22  24  26  28  3   31  33  5  7  9

/sys/kernel/capability/names:

cap_audit_control    cap_kill              cap_net_raw     cap_sys_nice
cap_audit_write      cap_lease             cap_setfcap     cap_sys_pacct
cap_chown            cap_linux_immutable   cap_setgid      cap_sys_ptrace
cap_dac_override     cap_mac_admin         cap_setpcap     cap_sys_rawio
cap_dac_read_search  cap_mac_override      cap_setuid      cap_sys_resource
cap_fowner           cap_mknod             cap_sys_admin   cap_sys_time
cap_fsetid           cap_net_admin         cap_sys_boot    cap_sys_tty_config
cap_ipc_lock         cap_net_bind_service  cap_sys_chroot
cap_ipc_owner        cap_net_broadcast     cap_sys_module

[kaigai@saba ~]$ cat /sys/kernel/capability/version 0x20071026
[kaigai@saba ~]$ cat /sys/kernel/capability/codes/30 cap_audit_control
[kaigai@saba ~]$ cat /sys/kernel/capability/names/cap_sys_pacct 20
[kaigai@saba ~]$
===================================================

Quoted 2 lines

As you are adding new sysfs entries, please also add the needed Documentation/ABI/ entries as well.

OK, I'll add a short description at Documentation/ABI/sysfs-kernel-capability .

Quoted 2 lines

Also, this code can be cleaned up a lot by just using the basic kobject attributes, and not rolling your own types here.

I replaced my own defined capability_attribute by kobj_attribute.

It made the patch cleaned up, however, it also impossible to share a single _show() method instance, because kobj_attribute does not have any private member. Is there any reason why kobj_attribute does not have "void *private;"?

Thanks,

Signed-off-by KaiGai Kohei <[email protected]>

--

 Documentation/ABI/testing/sysfs-kernel-capability |   23 +++++
 scripts/mkcapnames.sh                             |   44 +++++++++
 security/Makefile                                 |    9 ++
 security/commoncap.c                              |  102 +++++++++++++++++++++
 4 files changed, 178 insertions(+), 0 deletions(-)

Documentation/ABI/testing/sysfs-kernel-capability +23 -0

index e69de29..402ef06 100644
@@ -0,0 +1,23 @@
+What:		/sys/kernel/capability
+Date:		Feb 2008
+Contact:	KaiGai Kohei <[email protected]>
+Description:
+		The entries under /sys/kernel/capability are used to export
+		the list of capabilities the running kernel supported.
+
+		- /sys/kernel/capability/version
+		  returns the most preferable version number for the
+		  running kernel.
+		  e.g) $ cat /sys/kernel/capability/version
+		       0x20071026
+
+		- /sys/kernel/capability/code/<numerical representation>
+		  returns its symbolic representation, on reading.
+		  e.g) $ cat /sys/kernel/capability/codes/30
+		       cap_audit_control
+
+		- /sys/kernel/capability/name/<symbolic representation>
+		  returns its numerical representation, on reading.
+		  e.g) $ cat /sys/kernel/capability/names/cap_sys_pacct
+		       20
+

scripts/mkcapnames.sh +44 -0

index e69de29..5d36d52 100644
@@ -0,0 +1,44 @@
+#!/bin/sh
+
+#
+# generate a cap_names.h file from include/linux/capability.h
+#
+
+CAPHEAD="`dirname $0`/../include/linux/capability.h"
+REGEXP='^#define CAP_[A-Z_]+[ 	]+[0-9]+$'
+NUMCAP=`cat "$CAPHEAD" | egrep -c "$REGEXP"`
+
+echo '#ifndef CAP_NAMES_H'
+echo '#define CAP_NAMES_H'
+echo
+echo '/*'
+echo ' * Do NOT edit this file directly.'
+echo ' * This file is generated from include/linux/capability.h automatically'
+echo ' */'
+echo
+echo '#if !defined(SYSFS_CAP_NAME_ENTRY) || !defined(SYSFS_CAP_CODE_ENTRY)'
+echo '#error cap_names.h should be included from security/capability.c'
+echo '#else'
+echo "#if $NUMCAP != CAP_LAST_CAP + 1"
+echo '#error mkcapnames.sh cannot collect capabilities correctly'
+echo '#else'
+cat "$CAPHEAD" | egrep "$REGEXP" \
+    | awk '{ printf("SYSFS_CAP_NAME_ENTRY(%s,%s);\n", tolower($2), $2); }'
+echo
+echo 'static struct attribute *capability_name_attrs[] = {'
+cat "$CAPHEAD" | egrep "$REGEXP" \
+    | awk '{ printf("\t&%s_name_attr.attr,\n", tolower($2)); } END { print "\tNULL," }'
+echo '};'
+
+echo
+cat "$CAPHEAD" | egrep "$REGEXP" \
+    | awk '{ printf("SYSFS_CAP_CODE_ENTRY(%s,%s);\n", tolower($2), $2); }'
+echo
+echo 'static struct attribute *capability_code_attrs[] = {'
+cat "$CAPHEAD" | egrep "$REGEXP" \
+    | awk '{ printf("\t&%s_code_attr.attr,\n", tolower($2)); } END { print "\tNULL," }'
+echo '};'
+
+echo '#endif'
+echo '#endif'
+echo '#endif'

security/Makefile +9 -0

index 9e8b025..c1ffc00 100644
@@ -18,3 +18,12 @@ obj-$(CONFIG_SECURITY_SELINUX)		+= selinux/built-in.o
 obj-$(CONFIG_SECURITY_SMACK)		+= commoncap.o smack/built-in.o
 obj-$(CONFIG_SECURITY_CAPABILITIES)	+= commoncap.o capability.o
 obj-$(CONFIG_SECURITY_ROOTPLUG)		+= commoncap.o root_plug.o
+
+# cap_names.h contains the code/name pair of capabilities.
+# It is generated using include/linux/capability.h automatically.
+$(obj)/commoncap.o: $(obj)/cap_names.h
+quiet_cmd_cap_names  = CAPS    $@
+	cmd_cap_names  = /bin/sh $(src)/../scripts/mkcapnames.sh > $@
+targets += cap_names.h
+$(obj)/cap_names.h: $(src)/../scripts/mkcapnames.sh $(src)/../include/linux/capability.h FORCE
+	$(call if_changed,cap_names)

security/commoncap.c +49 -0

index 5aba826..0f2f778 100644
@@ -24,6 +24,8 @@
 #include <linux/hugetlb.h>
 #include <linux/mount.h>
 #include <linux/sched.h>
+#include <linux/kobject.h>
+#include <linux/sysfs.h>
 
 /* Global security state */
 

@@ -637,3 +639,103 @@ int cap_vm_enough_memory(struct mm_struct *mm, long pages)
 	return __vm_enough_memory(mm, pages, cap_sys_admin);
 }
 
+#ifdef CONFIG_SYSFS
+/*
+ * Export the list of capabilities on /sys/kernel/capability
+ */
+static struct kobject *capability_kobj;
+
+#define SYSFS_CAP_NAME_ENTRY(_name,_code)				\
+	static ssize_t capname_##_name##_show(struct kobject *kobj,	\
+					      struct kobj_attribute *attr, \
+					      char *buffer)		\
+	{								\
+		return scnprintf(buffer, PAGE_SIZE, "%d\n", _code);	\
+	}								\
+	static struct kobj_attribute _name##_name_attr = {		\
+		.attr = { .name = __stringify(_name), .mode = 0444, },	\
+		.show = capname_##_name##_show,				\
+	}
+
+#define SYSFS_CAP_CODE_ENTRY(_name,_code)				\
+	static ssize_t capcode_##_name##_show(struct kobject *kobj,	\
+					      struct kobj_attribute *attr, \
+					      char *buffer)		\
+	{								\
+		return scnprintf(buffer, PAGE_SIZE, "%s\n", __stringify(_name)); \
+	}								\
+	static struct kobj_attribute _name##_code_attr = {		\
+		.attr = { .name = __stringify(_code), .mode = 0444, },	\
+		.show = capcode_##_name##_show,				\
+	}
+
+/*
+ * capability_attrs[] is generated automatically by scripts/mkcapnames.sh
+ * This script parses include/linux/capability.h
+ */
+#include "cap_names.h"
+
+static struct attribute_group capability_name_attr_group = {
+	.name = "names",
+	.attrs = capability_name_attrs,
+};
+
+static struct attribute_group capability_code_attr_group = {
+	.name = "codes",
+	.attrs = capability_code_attrs,
+};
+
+static ssize_t capability_version_show(struct kobject *kobj,

security/commoncap.c +33 -0

+
+static int __init capability_export_names(void)
+{
+	int rc = -ENOMEM;
+
+	/* make /sys/kernel/capability */
+	capability_kobj = kobject_create_and_add("capability", kernel_kobj);
+	if (!capability_kobj)
+		goto error0;
+
+	/* make /sys/kernel/capability/names */
+	rc = sysfs_create_group(capability_kobj,
+				&capability_name_attr_group);
+	if (rc)
+		goto error1;
+
+	/* make /sys/kernel/capability/codes */
+	rc = sysfs_create_group(capability_kobj,
+				&capability_code_attr_group);
+	if (rc)
+		goto error2;
+
+	/* make /sys/kernel/capability/version */
+	rc = sysfs_create_file(capability_kobj,
+			       &cap_version_attr.attr);
+	if (rc)
+		goto error3;
+
+	return 0;
+
+error3:
+	sysfs_remove_group(capability_kobj, &capability_code_attr_group);
+error2:

Quoted 18 lines · Kohei KaiGai

Quoted 17 lines · Greg KH

Quoted 16 lines · Serge E. Hallyn

Quoted 16 lines

--------
This patch enables to export code/name of capabilities supported on the running kernel.

A newer kernel sometimes adds new capabilities, like CAP_MAC_ADMIN at 2.6.25. However, we have no interface to disclose what capabilities are supported on this kernel. Thus, we have to maintain libcap version in appropriate one synchronously.

This patch enables libcap to collect the list of capabilities on run time, and provide them for users.
It helps to improve portability of library.

It exports these information as regular files under /sys/kernel/capability. The numeric node exports its name, the symbolic node exports its code.

Quoted 5 lines

Quoted 3 lines

Quoted 3 lines

Quoted 1 line

Please consider to put this patch on the queue of 2.6.25.

Looks good, except don't you need to put the code in commoncap.c under a #ifdef SYSFS?

Fair enough.
I added the #ifdef - #endif block in this patch.

Not needed, if SYSFS is not build in, all of that code pretty much compiles away to nothing. So you can drop that.

Quoted 4 lines

Quoted 2 lines

Also, this code can be cleaned up a lot by just using the basic kobject attributes, and not rolling your own types here.

I replaced my own defined capability_attribute by kobj_attribute.

Quoted 3 lines

It made the patch cleaned up, however, it also impossible to share a single _show() method instance, because kobj_attribute does not have any private member. Is there any reason why kobj_attribute does not have "void *private;"?

Because no one has asked for it? :)

Or you can just do as the example in samples/kobject/ does it, no need for the void pointer as that code shows.

Review

Quoted 4 lines

(quoted diff) +4 -0

+static struct kobj_attribute cap_version_attr = {
+	.attr = { .name = "version", .mode = 0444 },
+	.show = capability_version_show,
+};

We do have macros for these kinds of things :)

Look at ATTR() and friends.

Quoted 36 lines

(quoted diff) +36 -0

+static int __init capability_export_names(void)
+{
+	int rc = -ENOMEM;
+
+	/* make /sys/kernel/capability */
+	capability_kobj = kobject_create_and_add("capability", kernel_kobj);
+	if (!capability_kobj)
+		goto error0;
+
+	/* make /sys/kernel/capability/names */
+	rc = sysfs_create_group(capability_kobj,
+				&capability_name_attr_group);
+	if (rc)
+		goto error1;
+
+	/* make /sys/kernel/capability/codes */
+	rc = sysfs_create_group(capability_kobj,
+				&capability_code_attr_group);
+	if (rc)
+		goto error2;
+
+	/* make /sys/kernel/capability/version */
+	rc = sysfs_create_file(capability_kobj,
+			       &cap_version_attr.attr);
+	if (rc)
+		goto error3;
+
+	return 0;
+
+error3:
+	sysfs_remove_group(capability_kobj, &capability_code_attr_group);
+error2:
+	sysfs_remove_group(capability_kobj, &capability_name_attr_group);
+error1:
+	kobject_put(capability_kobj);
+error0:

Review

Quoted 6 lines

(quoted diff) +6 -0

+	printk(KERN_ERR "Unable to export capabilities\n");
+
+	return rc;
+}
+__initcall(capability_export_names);
+#endif	/* CONFIG_SYSFS */

Where do you remove these files? Or will that never happen?

Quoted 4 lines · Greg KH

Quoted 4 lines

Quoted 2 lines

Also, this code can be cleaned up a lot by just using the basic kobject attributes, and not rolling your own types here.

I replaced my own defined capability_attribute by kobj_attribute.

Quoted 8 lines

Quoted 3 lines

It made the patch cleaned up, however, it also impossible to share a single _show() method instance, because kobj_attribute does not have any private member. Is there any reason why kobj_attribute does not have "void *private;"?

Because no one has asked for it? :)

Or you can just do as the example in samples/kobject/ does it, no need for the void pointer as that code shows.

It shows us a good example in samples/kobject.

However, it is unsuitable to export the list of capabilities.
The shared _show() method (b_show) calls strcmp() once with the name of kobject attribute to switch its returning string.
If we have 34 of candidates to be returned, like the capability case, we have to call strcmp() 33 times in maximum.

If we can have a private member in kobj_attribute, we can found the content to be returned in a single step.

Quoted 2 lines

If we can have a private member in kobj_attribute, we can found the content to be returned in a single step.

Ok, again, just send me a patch that adds this functionality and we will be very glad to consider it.

Quoted 1 line

Quoted 1 line

If we can have a private member in kobj_attribute, we can found the

content

Quoted 4 lines

Quoted 1 line

to be returned in a single step.

Ok, again, just send me a patch that adds this functionality and we will be very glad to consider it.

[1/2] Add a private data field within kobj_attribute structure.

This patch add a private data field, declared as void *, within kobj_attribute
structure. Anyone wants to use sysfs can store their private data to refer at
_show() and _store() method.
It enables to share a single method function with several similar entries, like ones to export the list of capabilities the running kernel supported.

include/linux/kobject.h +0 -0

 extern struct sysfs_ops kobj_sysfs_ops;

include/linux/sysfs.h +0 -0

index 8027104..6f40ff9 100644

Quoted 7 lines · Kohei KaiGai

Quoted 1 line

Quoted 1 line

If we can have a private member in kobj_attribute, we can found the

content

Quoted 3 lines

Quoted 1 line

to be returned in a single step.

Ok, again, just send me a patch that adds this functionality and we will be very glad to consider it.

[1/2] Add a private data field within kobj_attribute structure.

Quoted 5 lines

This patch add a private data field, declared as void *, within kobj_attribute structure. Anyone wants to use sysfs can store their private data to refer at _show() and _store() method.
It enables to share a single method function with several similar entries, like ones to export the list of capabilities the running kernel supported.

But your patch 2/2 doesn't use this interface, why not?

Quoted 4 lines

 include/linux/kobject.h |    1 +
 include/linux/sysfs.h   |    7 +++++++
 2 files changed, 8 insertions(+), 0 deletions(-)

include/linux/kobject.h struct kobj_attribute { · line 133

Quoted 9 lines

include/linux/kobject.h +1 -0

index caa3f41..57d5bf1 100644
@@ -130,6 +130,7 @@ struct kobj_attribute {
 			char *buf);
 	ssize_t (*store)(struct kobject *kobj, struct kobj_attribute *attr,
 			 const char *buf, size_t count);
+	void *data;	/* a private field */

Hm, can you really use this?

Quoted 9 lines

include/linux/kobject.h +0 -0

 extern struct sysfs_ops kobj_sysfs_ops;

include/linux/sysfs.h +0 -0

index 8027104..6f40ff9 100644
@@ -50,6 +50,13 @@ struct attribute_group {
 	.store	= _store,					\
 }
 

include/linux/sysfs.h struct attribute_group { · line 58

Quoted 6 lines

include/linux/sysfs.h +6 -0

+#define __ATTR_DATA(_name,_mode,_show,_store,_data) {		\
+	.attr = {.name = __stringify(_name), .mode = _mode },   \
+	.show	= _show,					\
+	.store	= _store,					\
+	.data	= (void *)(_data),				\
+}

I don't see how this would be any different from the original? You are always passed a kobject, which can be embedded in anything else.

Could you also modify the documentation and the sample code to use this new field, showing how it is to be used, and testing that it works properly at the same time?

Quoted 17 lines · Greg KH

Quoted 7 lines · Kohei KaiGai

Quoted 1 line

Quoted 1 line

If we can have a private member in kobj_attribute, we can found the

content

Quoted 3 lines

Quoted 1 line

to be returned in a single step.

Ok, again, just send me a patch that adds this functionality and we will be very glad to consider it.

[1/2] Add a private data field within kobj_attribute structure.

Quoted 9 lines

This patch add a private data field, declared as void *, within kobj_attribute
structure. Anyone wants to use sysfs can store their private data to refer at
_show() and _store() method.
It enables to share a single method function with several similar entries,
like ones to export the list of capabilities the running kernel supported.

Quoted 1 line

But your patch 2/2 doesn't use this interface, why not?

Really?
The following two _show() methods shared by every capabilities refer the private member of kobj_attribute.

| +static ssize_t capability_name_show(struct kobject *kobj,
| +                    struct kobj_attribute *attr,
| +                    char *buffer)
| +{
| +    /* It returns numerical representation of capability. */
| +    return scnprintf(buffer, PAGE_SIZE, "%d\n", (int) attr->data);
| +}
| +
| +static ssize_t capability_code_show(struct kobject *kobj,
| +                    struct kobj_attribute *attr,
| +                    char *buffer)
| +{
| +    /* It returns symbolic representation of capability. */
| +    return scnprintf(buffer, PAGE_SIZE, "%s\n", (char *) attr->data);
| +}

Quoted 3 lines

Could you also modify the documentation and the sample code to use this new field, showing how it is to be used, and testing that it works properly at the same time?

OK, Please wait for a while.

Quoted 20 lines · Kohei KaiGai

Quoted 11 lines · Greg KH

Quoted 7 lines

Quoted 2 lines

Also, this code can be cleaned up a lot by just using the basic kobject attributes, and not rolling your own types here.

I replaced my own defined capability_attribute by kobj_attribute.

It made the patch cleaned up, however, it also impossible to share a single _show() method instance, because kobj_attribute does not have any private member. Is there any reason why kobj_attribute does not have "void *private;"?

Because no one has asked for it? :)

Or you can just do as the example in samples/kobject/ does it, no need for the void pointer as that code shows.

It shows us a good example in samples/kobject.

However, it is unsuitable to export the list of capabilities.
The shared _show() method (b_show) calls strcmp() once with the name of kobject attribute to switch its returning string.
If we have 34 of candidates to be returned, like the capability case, we have to call strcmp() 33 times in maximum.

Quoted 2 lines

If we can have a private member in kobj_attribute, we can found the content to be returned in a single step.

Ok, again, just send me a patch that adds this functionality and we will be very glad to consider it.

Quoted 19 lines · Kohei KaiGai

Quoted 18 lines · Greg KH

Quoted 17 lines · Serge E. Hallyn

Quoted 17 lines

--------
This patch enables to export code/name of capabilities supported on the running kernel.

A newer kernel sometimes adds new capabilities, like CAP_MAC_ADMIN at 2.6.25. However, we have no interface to disclose what capabilities are supported on this kernel. Thus, we have to maintain libcap version in appropriate one synchronously.

This patch enables libcap to collect the list of capabilities on run time, and provide them for users.
It helps to improve portability of library.

It exports these information as regular files under /sys/kernel/capability. The numeric node exports its name, the symbolic node exports its code.

Please consider to put this patch on the queue of 2.6.25.

Quoted 5 lines

Quoted 2 lines

Quoted 2 lines

Looks good, except don't you need to put the code in commoncap.c under a #ifdef SYSFS?

Fair enough.
I added the #ifdef - #endif block in this patch.

Not needed, if SYSFS is not build in, all of that code pretty much compiles away to nothing. So you can drop that.