TononixOS/ubports_kernel_google_msm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

security: Add AID_NET_RAW and AID_NET_ADMIN capability check in cap_capable().

Browse Source 
Signed-off-by: Chia-chi Yeh <chiachi@android.com>
This commit is contained in:
Chia-chi Yeh
2009-06-19 07:15:05 +08:00
committed by Colin Cross
parent c54f674c65
commit 0432013eb1
2 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
include/linux/android_aid.h
View File

@@ -21,5 +21,6 @@
#define AID_NET_BT 3002 #define AID_NET_BT 3002
#define AID_INET 3003 #define AID_INET 3003
#define AID_NET_RAW 3004 #define AID_NET_RAW 3004
#define AID_NET_ADMIN 3005
#endif #endif

9
security/commoncap.c
View File

@@ -30,6 +30,10 @@
#include <linux/user_namespace.h> #include <linux/user_namespace.h>
#include <linux/binfmts.h> #include <linux/binfmts.h>
#ifdef CONFIG_ANDROID_PARANOID_NETWORK
#include <linux/android_aid.h>
#endif
/* /*
* If a non-root user executes a setuid-root binary in * If a non-root user executes a setuid-root binary in
* !secure(SECURE_NOROOT) mode, then we raise capabilities. * !secure(SECURE_NOROOT) mode, then we raise capabilities.
@@ -75,6 +79,11 @@ int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
int cap_capable(const struct cred *cred, struct user_namespace *targ_ns, int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
int cap, int audit) int cap, int audit)
{ {
if (cap == CAP_NET_RAW && in_egroup_p(AID_NET_RAW))
return 0;
if (cap == CAP_NET_ADMIN && in_egroup_p(AID_NET_ADMIN))
return 0;
for (;;) { for (;;) {
/* The creator of the user namespace has all caps. */ /* The creator of the user namespace has all caps. */
if (targ_ns != &init_user_ns && targ_ns->creator == cred->user) if (targ_ns != &init_user_ns && targ_ns->creator == cred->user)