LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: KaiGai Kohei <kaigai@ak.jp.nec.com>
To: greg@kroah.com, morgan@kernel.org, serue@us.ibm.com, chrisw@sous-sol.org
Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 0/3] exporting capability name/code pairs (for 2.6.26)
Date: Tue, 22 Apr 2008 20:12:15 +0900	[thread overview]
Message-ID: <480DC80F.3060403@ak.jp.nec.com> (raw)
In-Reply-To: <47C25AE9.7080305@ak.jp.nec.com>

The following three patches enables to export code/name pairs of
capabilities the running kernel supports, and add a documentation
and samples to use this feature.
It was too late for 2.6.25 merge window, so I submit them again
for the next development cycle.

[PATCH 1/3] add a private data field within kobj_attribute structure.

This patch add a private data field, declared as void *, within kobj_attribute
structure. The _show() and _store() method in the sysfs attribute entries can
refer this information to identify what entry is accessed.
It makes easier to share a single method implementation with several similar
entries, like ones to export the list of capabilities the running kernel
supports.

[PATCH 2/3] exporting capability name/code pairs

This patch enables to export code/name pairs of capabilities the running
kernel supported.

A newer kernel sometimes adds new capabilities, like CAP_MAC_ADMIN
at 2.6.25. However, we have no interface to disclose what capabilities
are supported on the running kernel. Thus, we have to maintain libcap
version in appropriate one synchronously.

This patch enables libcap to collect the list of capabilities at run time,
and provide them for users. It helps to improve portability of library.

It exports these information as regular files under /sys/kernel/capability.
The numeric node exports its name, the symbolic node exports its code.

[PATCH 3/3] a new example to use kobject/kobj_attribute

This patch can provide a new exmple to use kobject and attribute.
The _show() and _store() method can refer/store the private data field of
kobj_attribute structure to know what entries are accessed by users.
It will make easier to share a single _show()/_store() method with several
entries.

--------------
Example of execution:
[kaigai@saba ~]$ uname -r
2.6.25.capnames
[kaigai@saba ~]$ ls -R /sys/kernel/capability/
/sys/kernel/capability/:
codes  names  version

/sys/kernel/capability/codes:
0  10  12  14  16  18  2   21  23  25  27  29  30  32  4  6  8
1  11  13  15  17  19  20  22  24  26  28  3   31  33  5  7  9

/sys/kernel/capability/names:
cap_audit_control    cap_kill              cap_net_raw     cap_sys_nice
cap_audit_write      cap_lease             cap_setfcap     cap_sys_pacct
cap_chown            cap_linux_immutable   cap_setgid      cap_sys_ptrace
cap_dac_override     cap_mac_admin         cap_setpcap     cap_sys_rawio
cap_dac_read_search  cap_mac_override      cap_setuid      cap_sys_resource
cap_fowner           cap_mknod             cap_sys_admin   cap_sys_time
cap_fsetid           cap_net_admin         cap_sys_boot    cap_sys_tty_config
cap_ipc_lock         cap_net_bind_service  cap_sys_chroot
cap_ipc_owner        cap_net_broadcast     cap_sys_module
[kaigai@saba ~]$ cat /sys/kernel/capability/names/cap_sys_pacct
20
[kaigai@saba ~]$ cat /sys/kernel/capability/codes/16
cap_sys_module
[kaigai@saba ~]$
--------------

Thanks,
-- 
OSS Platform Development Division, NEC
KaiGai Kohei <kaigai@ak.jp.nec.com>

  parent reply	other threads:[~2008-04-22 11:16 UTC|newest]

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2008-02-25  6:06 [PATCH 0/3] exporting capability name/code pairs (final#2) Kohei KaiGai
2008-02-25  6:10 ` [PATCH 1/3] add a private data field within kobj_attribute structure (final#2) Kohei KaiGai
2008-02-25  6:51   ` Greg KH
2008-02-25  6:57     ` Kohei KaiGai
2008-02-25  7:47       ` Greg KH
2008-02-25 10:04         ` Kohei KaiGai
2008-02-26 20:09           ` Greg KH
2008-02-28  5:49   ` Valdis.Kletnieks
2008-03-03  4:42     ` Kohei KaiGai
2008-02-25  6:10 ` [PATCH 2/3] exporting capability name/code pairs (final#2) Kohei KaiGai
2008-02-26 14:55   ` Andrew G. Morgan
2008-02-26 20:58     ` Serge E. Hallyn
2008-03-07  4:30       ` Kohei KaiGai
2008-03-07  4:53         ` Greg KH
2008-02-25  6:10 ` [PATCH 3/3] a new example to use kobject/kobj_attribute (final#2) Kohei KaiGai
2008-04-22 11:12 ` KaiGai Kohei [this message]
2008-04-22 11:17   ` [PATCH 1/3] add a private data field within kobj_attribute structure KaiGai Kohei
2008-04-22 11:18   ` [PATCH 2/3] exporting capability name/code pairs KaiGai Kohei
2008-04-22 11:18   ` [PATCH 3/3] a new example to use kobject/kobj_attribute KaiGai Kohei
2008-04-22 19:29   ` [PATCH 0/3] exporting capability name/code pairs (for 2.6.26) Alexey Dobriyan
2008-04-23  0:38     ` KaiGai Kohei
2008-04-23  7:03       ` Alexey Dobriyan
2008-04-23  7:37         ` KaiGai Kohei
2008-05-13 22:12           ` Alexey Dobriyan
2008-05-14  0:34             ` KaiGai Kohei
2008-04-23  5:37   ` Chris Wright
2008-04-23  7:15     ` KaiGai Kohei
2008-05-14  0:36       ` KaiGai Kohei
2008-05-14  0:52         ` Chris Wright
2008-05-14  5:57           ` KaiGai Kohei
2008-05-15  5:48             ` Andrew Morgan
2008-05-15  7:47               ` KaiGai Kohei

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=480DC80F.3060403@ak.jp.nec.com \
    --to=kaigai@ak.jp.nec.com \
    --cc=chrisw@sous-sol.org \
    --cc=greg@kroah.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=morgan@kernel.org \
    --cc=serue@us.ibm.com \
    --subject='Re: [PATCH 0/3] exporting capability name/code pairs (for 2.6.26)' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).