shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-04-05 04:33:05 +09:00
Code Issues Packages Projects Releases Wiki Activity

security: Add AID_NET_RAW and AID_NET_ADMIN capability check in cap_capable().

Browse Source 
Signed-off-by: Chia-chi Yeh <chiachi@android.com>
This commit is contained in:
Chia-chi Yeh
2009-06-19 07:15:05 +08:00
committed by Arve Hjønnevåg
parent 286fcd1c1e
commit c30cd45aad
2 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/android_aid.h
View File

@@ -21,5 +21,6 @@
#define AID_NET_BT 3002
#define AID_INET 3003
#define AID_NET_RAW 3004
#define AID_NET_ADMIN 3005
#endif

10
security/commoncap.c
View File

@@ -28,6 +28,10 @@
#include <linux/prctl.h>
#include <linux/securebits.h>
#ifdef CONFIG_ANDROID_PARANOID_NETWORK
#include <linux/android_aid.h>
#endif
/*
* If a non-root user executes a setuid-root binary in
* !secure(SECURE_NOROOT) mode, then we raise capabilities.
@@ -82,6 +86,12 @@ EXPORT_SYMBOL(cap_netlink_recv);
int cap_capable(struct task_struct *tsk, const struct cred *cred, int cap,
int audit)
{
#ifdef CONFIG_ANDROID_PARANOID_NETWORK
if (cap == CAP_NET_RAW && in_egroup_p(AID_NET_RAW))
return 0;
if (cap == CAP_NET_ADMIN && in_egroup_p(AID_NET_ADMIN))
return 0;
#endif
return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
}