kernel_optimize_test/kernel
Andrew G. Morgan 3898b1b4eb capabilities: implement per-process securebits
Filesystem capability support makes it possible to do away with (set)uid-0
based privilege and use capabilities instead.  That is, with filesystem
support for capabilities but without this present patch, it is (conceptually)
possible to manage a system with capabilities alone and never need to obtain
privilege via (set)uid-0.

Of course, conceptually isn't quite the same as currently possible since few
user applications, certainly not enough to run a viable system, are currently
prepared to leverage capabilities to exercise privilege.  Further, many
applications exist that may never get upgraded in this way, and the kernel
will continue to want to support their setuid-0 base privilege needs.

Where pure-capability applications evolve and replace setuid-0 binaries, it is
desirable that there be a mechanisms by which they can contain their
privilege.  In addition to leveraging the per-process bounding and inheritable
sets, this should include suppressing the privilege of the uid-0 superuser
from the process' tree of children.

The feature added by this patch can be leveraged to suppress the privilege
associated with (set)uid-0.  This suppression requires CAP_SETPCAP to
initiate, and only immediately affects the 'current' process (it is inherited
through fork()/exec()).  This reimplementation differs significantly from the
historical support for securebits which was system-wide, unwieldy and which
has ultimately withered to a dead relic in the source of the modern kernel.

With this patch applied a process, that is capable(CAP_SETPCAP), can now drop
all legacy privilege (through uid=0) for itself and all subsequently
fork()'d/exec()'d children with:

  prctl(PR_SET_SECUREBITS, 0x2f);

This patch represents a no-op unless CONFIG_SECURITY_FILE_CAPABILITIES is
enabled at configure time.

[akpm@linux-foundation.org: fix uninitialised var warning]
[serue@us.ibm.com: capabilities: use cap_task_prctl when !CONFIG_SECURITY]
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Reviewed-by: James Morris <jmorris@namei.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Paul Moore <paul.moore@hp.com>
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-28 08:58:26 -07:00
..
irq cpumask: Cleanup more uses of CPU_MASK and NODE_MASK 2008-04-19 19:44:58 +02:00
power Merge branches 'release' and 'doc' into release 2008-03-13 01:59:53 -04:00
time softlockup: fix NOHZ wakeup 2008-04-25 00:25:08 +02:00
.gitignore Update kernel/.gitignore with new auto-generated files 2008-02-09 23:27:01 -08:00
acct.c bsd_acct: using task_struct->tgid is not right in pid-namespaces 2008-03-24 19:22:20 -07:00
audit_tree.c Introduce path_put() 2008-02-14 21:13:33 -08:00
audit.c Audit: internally use the new LSM audit hooks 2008-04-19 09:52:37 +10:00
audit.h SELinux: use new audit hooks, remove redundant exports 2008-04-19 09:53:46 +10:00
auditfilter.c Audit: Final renamings and cleanup 2008-04-19 09:59:43 +10:00
auditsc.c Audit: Final renamings and cleanup 2008-04-19 09:59:43 +10:00
backtracetest.c
bounds.c mm: Get rid of __ZONE_COUNT 2008-04-28 08:58:22 -07:00
capability.c Add 64-bit capability support to the kernel 2008-02-05 09:44:20 -08:00
cgroup_debug.c
cgroup.c cgroup: fix a race condition in manipulating tsk->cg_list 2008-04-18 08:17:57 -07:00
compat.c generic: reduce stack pressure in sched_affinity 2008-04-19 19:44:59 +02:00
configs.c
cpu.c generic: use new set_cpus_allowed_ptr function 2008-04-19 19:44:58 +02:00
cpuset.c mempolicy: rename mpol_copy to mpol_dup 2008-04-28 08:58:23 -07:00
delayacct.c
dma.c
exec_domain.c
exit.c mempolicy: rename mpol_free to mpol_put 2008-04-28 08:58:23 -07:00
extable.c
fork.c mempolicy: rename mpol_copy to mpol_dup 2008-04-28 08:58:23 -07:00
futex_compat.c futex_compat __user annotation 2008-03-30 14:18:41 -07:00
futex.c NULL noise: fs/*, mm/*, kernel/* 2008-03-30 14:18:41 -07:00
hrtimer.c hrtimer: optimize the softirq time optimization 2008-04-21 07:59:51 +02:00
itimer.c ITIMER_REAL: convert to use struct pid 2008-02-08 09:22:29 -08:00
kallsyms.c remove support for un-needed _extratext section 2008-02-06 10:41:01 -08:00
Kconfig.hz
Kconfig.preempt rcu: move PREEMPT_RCU config option back under PREEMPT 2008-03-10 18:01:20 -07:00
kexec.c vmcoreinfo: add page flags values 2008-04-28 08:58:23 -07:00
kfifo.c
kgdb.c kgdb: always use icache flush for sw breakpoints 2008-04-17 20:05:43 +02:00
kmod.c generic: use new set_cpus_allowed_ptr function 2008-04-19 19:44:58 +02:00
kprobes.c kprobes: fix a null pointer bug in register_kretprobe() 2008-03-04 16:35:19 -08:00
ksysfs.c
kthread.c Merge branch 'semaphore' of git://git.kernel.org/pub/scm/linux/kernel/git/willy/misc 2008-04-21 15:41:27 -07:00
latencytop.c latencytop: optimize LT_BACKTRACEDEPTH loops a bit 2008-04-19 19:44:57 +02:00
lockdep_internals.h
lockdep_proc.c
lockdep.c Subject: lockdep: include all lock classes in all_lock_classes 2008-02-25 23:03:02 +01:00
Makefile Merge git://git.kernel.org/pub/scm/linux/kernel/git/mingo/linux-2.6-kgdb 2008-04-18 08:37:01 -07:00
marker.c markers: use synchronize_sched() 2008-04-02 15:28:19 -07:00
module.c kernel: Remove unnecessary inclusions of asm/semaphore.h 2008-04-18 22:17:04 -04:00
mutex-debug.c kernel: remove fastcall in kernel/* 2008-02-08 09:22:31 -08:00
mutex-debug.h
mutex.c kernel: remove fastcall in kernel/* 2008-02-08 09:22:31 -08:00
mutex.h
notifier.c kernel/notifier.c should #include <linux/reboot.h> 2008-02-06 10:41:02 -08:00
ns_cgroup.c
nsproxy.c namespaces: move the IPC namespace under IPC_NS option 2008-02-08 09:22:23 -08:00
panic.c ACPI: Taint kernel on ACPI table override (format corrected) 2008-02-06 22:07:51 -05:00
params.c Add new string functions strict_strto* and convert kernel params to use them 2008-02-08 09:22:41 -08:00
pid_namespace.c namespaces: cleanup the code managed with PID_NS option 2008-02-08 09:22:23 -08:00
pid.c kernel: remove fastcall in kernel/* 2008-02-08 09:22:31 -08:00
pm_qos_params.c pm qos infrastructure and interface 2008-02-05 09:44:22 -08:00
posix-cpu-timers.c posix-timers: fix shadowed variables 2008-04-17 12:22:30 +02:00
posix-timers.c kernel: Remove unnecessary inclusions of asm/semaphore.h 2008-04-18 22:17:04 -04:00
printk.c Fix locking bug in "acquire_console_semaphore_for_printk()" 2008-04-15 13:09:54 -07:00
profile.c kernel: Remove unnecessary inclusions of asm/semaphore.h 2008-04-18 22:17:04 -04:00
ptrace.c ptrace: compat_ptrace_request siginfo 2008-04-21 15:53:41 -07:00
rcuclassic.c
rcupdate.c rcupdate: fix comment 2008-02-13 16:21:18 -08:00
rcupreempt_trace.c
rcupreempt.c generic: reduce stack pressure in sched_affinity 2008-04-19 19:44:59 +02:00
rcutorture.c generic: use new set_cpus_allowed_ptr function 2008-04-19 19:44:58 +02:00
relay.c relay: set an spd_release() hook for splice 2008-03-26 12:04:09 +01:00
res_counter.c Memory Resource Controller use strstrip while parsing arguments 2008-03-04 16:35:09 -08:00
resource.c PCI: clean up resource alignment management 2008-04-20 21:47:08 -07:00
rtmutex_common.h Don't operate with pid_t in rtmutex tester 2008-02-08 09:22:41 -08:00
rtmutex-debug.c Don't operate with pid_t in rtmutex tester 2008-02-08 09:22:41 -08:00
rtmutex-debug.h
rtmutex-tester.c
rtmutex.c hrtimer: more hrtimer_init_sleeper() fallout. 2008-02-13 15:45:36 +01:00
rtmutex.h
rwsem.c
sched_debug.c sched: build fix 2008-04-19 19:45:01 +02:00
sched_fair.c sched: debug: show a weight tree 2008-04-19 19:45:00 +02:00
sched_features.h sched: /debug/sched_features 2008-04-19 19:45:00 +02:00
sched_idletask.c
sched_rt.c sched: rt-group: optimize dequeue_rt_stack 2008-04-19 19:45:00 +02:00
sched_stats.h cpumask: use new cpus_scnprintf function 2008-04-19 19:44:59 +02:00
sched.c Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6 2008-04-25 12:50:00 -07:00
seccomp.c
semaphore.c Improve semaphore documentation 2008-04-17 10:43:01 -04:00
signal.c trivial: small cleanups 2008-04-21 22:15:06 +00:00
softirq.c tasklets: execute tasklets in the same order they were queued 2008-04-19 19:44:58 +02:00
softlockup.c softlockup: fix task state setting 2008-02-29 18:46:53 +01:00
spinlock.c
srcu.c make srcu_readers_active() static 2008-02-06 10:41:02 -08:00
stacktrace.c
stop_machine.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/juhl/trivial 2008-04-21 16:36:46 -07:00
sys_ni.c timerfd: new timerfd API 2008-02-05 09:44:07 -08:00
sys.c capabilities: implement per-process securebits 2008-04-28 08:58:26 -07:00
sysctl_check.c constify tables in kernel/sysctl_check.c 2008-02-08 09:22:31 -08:00
sysctl.c sched: rt-group: synchonised bandwidth period 2008-04-19 19:44:57 +02:00
taskstats.c
test_kprobes.c kprobes: kretprobe user entry-handler 2008-02-06 10:41:11 -08:00
time.c time: Export set_normalized_timespec. 2008-04-21 19:45:12 -07:00
timeconst.pl timeconst.pl: correct reversal of USEC_TO_HZ and HZ_TO_USEC 2008-02-12 14:29:26 -08:00
timer.c timers: simplify lockdep handling 2008-04-17 12:22:31 +02:00
tsacct.c
uid16.c asmlinkage_protect replaces prevent_tail_call 2008-04-10 17:28:26 -07:00
user_namespace.c namespaces: cleanup the code managed with the USER_NS option 2008-02-08 09:22:23 -08:00
user.c sched: fix the task_group hierarchy for UID grouping 2008-04-19 19:45:00 +02:00
utsname_sysctl.c
utsname.c
wait.c kernel: remove fastcall in kernel/* 2008-02-08 09:22:31 -08:00
workqueue.c timer_list: add annotations to workqueue.c 2008-04-17 12:22:30 +02:00