linux/security/apparmor
Serge E. Hallyn 3486740a4f userns: security: make capabilities relative to the user namespace
- Introduce ns_capable to test for a capability in a non-default
  user namespace.
- Teach cap_capable to handle capabilities in a non-default
  user namespace.

The motivation is to get to the unprivileged creation of new
namespaces.  It looks like this gets us 90% of the way there, with
only potential uid confusion issues left.

I still need to handle getting all caps after creation but otherwise I
think I have a good starter patch that achieves all of your goals.

Changelog:
	11/05/2010: [serge] add apparmor
	12/14/2010: [serge] fix capabilities to created user namespaces
	Without this, if user serge creates a user_ns, he won't have
	capabilities to the user_ns he created.  THis is because we
	were first checking whether his effective caps had the caps
	he needed and returning -EPERM if not, and THEN checking whether
	he was the creator.  Reverse those checks.
	12/16/2010: [serge] security_real_capable needs ns argument in !security case
	01/11/2011: [serge] add task_ns_capable helper
	01/11/2011: [serge] add nsown_capable() helper per Bastian Blank suggestion
	02/16/2011: [serge] fix a logic bug: the root user is always creator of
		    init_user_ns, but should not always have capabilities to
		    it!  Fix the check in cap_capable().
	02/21/2011: Add the required user_ns parameter to security_capable,
		    fixing a compile failure.
	02/23/2011: Convert some macros to functions as per akpm comments.  Some
		    couldn't be converted because we can't easily forward-declare
		    them (they are inline if !SECURITY, extern if SECURITY).  Add
		    a current_user_ns function so we can use it in capability.h
		    without #including cred.h.  Move all forward declarations
		    together to the top of the #ifdef __KERNEL__ section, and use
		    kernel-doc format.
	02/23/2011: Per dhowells, clean up comment in cap_capable().
	02/23/2011: Per akpm, remove unreachable 'return -EPERM' in cap_capable.

(Original written and signed off by Eric;  latest, modified version
acked by him)

[akpm@linux-foundation.org: fix build]
[akpm@linux-foundation.org: export current_user_ns() for ecryptfs]
[serge.hallyn@canonical.com: remove unneeded extra argument in selinux's task_has_capability]
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Serge E. Hallyn <serge.hallyn@canonical.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Acked-by: Daniel Lezcano <daniel.lezcano@free.fr>
Acked-by: David Howells <dhowells@redhat.com>
Cc: James Morris <jmorris@namei.org>
Signed-off-by: Serge E. Hallyn <serge.hallyn@canonical.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2011-03-23 19:47:02 -07:00
..
include Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2011-01-13 10:05:56 -08:00
.gitignore .gitignore: ignore apparmor/rlim_names.h 2010-10-21 10:12:35 +11:00
apparmorfs.c Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl 2010-10-22 10:52:56 -07:00
audit.c AppArmor: basic auditing infrastructure. 2010-08-02 15:35:11 +10:00
capability.c AppArmor: mediation of non file objects 2010-08-02 15:38:35 +10:00
context.c AppArmor: contexts used in attaching policy to system objects 2010-08-02 15:35:12 +10:00
domain.c AppArmor: fix build warnings for non-const use of get_task_cred 2010-08-02 15:49:00 +10:00
file.c AppArmor: file enforcement routines 2010-08-02 15:35:14 +10:00
ipc.c AppArmor: fix build warnings for non-const use of get_task_cred 2010-08-02 15:49:00 +10:00
Kconfig apparmor: depends on NET 2010-08-05 07:36:51 -04:00
lib.c AppArmor: Fix splitting an fqname into separate namespace and profile names 2010-09-08 09:19:31 +10:00
lsm.c userns: security: make capabilities relative to the user namespace 2011-03-23 19:47:02 -07:00
Makefile AppArmor: cleanup generated files correctly 2011-03-08 17:03:53 -08:00
match.c AppArmor: dfa match engine 2010-08-02 15:35:13 +10:00
path.c fs: take dcache_lock inside __d_path 2010-10-25 21:26:12 -04:00
policy_unpack.c AppArmor: policy routines for loading and unpacking policy 2010-08-02 15:38:36 +10:00
policy.c APPARMOR: Fix memory leak of alloc_namespace() 2010-11-11 07:36:18 +11:00
procattr.c AppArmor: userspace interfaces 2010-08-02 15:35:13 +10:00
resource.c AppArmor: Fix security_task_setrlimit logic for 2.6.36 changes 2010-09-08 09:19:29 +10:00
sid.c AppArmor: core policy routines 2010-08-02 15:38:37 +10:00