kernel_cap_t
kernel_cap_t *a)
kernel_cap_t cap_inheritable, cap_permitted, cap_effective,
static inline bool cap_isidentical(const kernel_cap_t a, const kernel_cap_t b)
static inline bool cap_issubset(const kernel_cap_t a, const kernel_cap_t set)
static inline kernel_cap_t cap_drop_fs_set(const kernel_cap_t a)
static inline kernel_cap_t cap_raise_fs_set(const kernel_cap_t a,
const kernel_cap_t permitted)
static inline kernel_cap_t cap_drop_nfsd_set(const kernel_cap_t a)
static inline kernel_cap_t cap_raise_nfsd_set(const kernel_cap_t a,
const kernel_cap_t permitted)
kernel_cap_t permitted;
kernel_cap_t inheritable;
#define _KERNEL_CAP_T_SIZE (sizeof(kernel_cap_t))
# define CAP_EMPTY_SET ((kernel_cap_t) { 0 })
# define CAP_FULL_SET ((kernel_cap_t) { CAP_VALID_MASK })
# define CAP_FS_SET ((kernel_cap_t) { CAP_FS_MASK | BIT_ULL(CAP_LINUX_IMMUTABLE) })
# define CAP_NFSD_SET ((kernel_cap_t) { CAP_FS_MASK | BIT_ULL(CAP_SYS_RESOURCE) })
static inline kernel_cap_t cap_combine(const kernel_cap_t a,
const kernel_cap_t b)
return (kernel_cap_t) { a.val | b.val };
static inline kernel_cap_t cap_intersect(const kernel_cap_t a,
const kernel_cap_t b)
return (kernel_cap_t) { a.val & b.val };
static inline kernel_cap_t cap_drop(const kernel_cap_t a,
const kernel_cap_t drop)
return (kernel_cap_t) { a.val &~ drop.val };
static inline bool cap_isclear(const kernel_cap_t a)
kernel_cap_t cap_inheritable; /* caps our children can inherit */
kernel_cap_t cap_permitted; /* caps we're permitted */
kernel_cap_t cap_effective; /* caps we can actually use */
kernel_cap_t cap_bset; /* capability bounding set */
kernel_cap_t cap_ambient; /* Ambient capability set */
LSM_HOOK(int, 0, capget, const struct task_struct *target, kernel_cap_t *effective,
kernel_cap_t *inheritable, kernel_cap_t *permitted)
const kernel_cap_t *effective, const kernel_cap_t *inheritable,
const kernel_cap_t *permitted)
extern int cap_capget(const struct task_struct *target, kernel_cap_t *effective,
kernel_cap_t *inheritable, kernel_cap_t *permitted);
const kernel_cap_t *effective,
const kernel_cap_t *inheritable,
const kernel_cap_t *permitted);
kernel_cap_t *effective,
kernel_cap_t *inheritable,
kernel_cap_t *permitted);
const kernel_cap_t *effective,
const kernel_cap_t *inheritable,
const kernel_cap_t *permitted);
kernel_cap_t *effective,
kernel_cap_t *inheritable,
kernel_cap_t *permitted)
const kernel_cap_t *effective,
const kernel_cap_t *inheritable,
const kernel_cap_t *permitted)
kernel_cap_t permitted;
kernel_cap_t inheritable;
kernel_cap_t effective; /* effective set of process */
kernel_cap_t ambient;
kernel_cap_t *cap)
static inline int cap_get_target_pid(pid_t pid, kernel_cap_t *pEp,
kernel_cap_t *pIp, kernel_cap_t *pPp)
kernel_cap_t pE, pI, pP;
static kernel_cap_t mk_kernel_cap(u32 low, u32 high)
return (kernel_cap_t) { (low | ((u64)high << 32)) & CAP_VALID_MASK };
kernel_cap_t inheritable, permitted, effective;
static kernel_cap_t usermodehelper_bset = CAP_FULL_SET;
static kernel_cap_t usermodehelper_inheritable = CAP_FULL_SET;
kernel_cap_t new_cap, *cap;
kernel_cap_t aa_profile_capget(struct aa_profile *profile)
kernel_cap_t caps = CAP_EMPTY_SET;
kernel_cap_t allow;
kernel_cap_t audit;
kernel_cap_t denied;
kernel_cap_t quiet;
kernel_cap_t kill;
kernel_cap_t extended;
kernel_cap_t aa_profile_capget(struct aa_profile *profile);
static int apparmor_capget(const struct task_struct *target, kernel_cap_t *effective,
kernel_cap_t *inheritable, kernel_cap_t *permitted)
kernel_cap_t allowed;
kernel_cap_t tmpcap;
static bool aa_unpack_cap_low(struct aa_ext *e, kernel_cap_t *data, const char *name)
static bool aa_unpack_cap_high(struct aa_ext *e, kernel_cap_t *data, const char *name)
const kernel_cap_t *caller_caps;
int cap_capget(const struct task_struct *target, kernel_cap_t *effective,
kernel_cap_t *inheritable, kernel_cap_t *permitted)
const kernel_cap_t *effective,
const kernel_cap_t *inheritable,
const kernel_cap_t *permitted)
kernel_cap_t *effective,
kernel_cap_t *inheritable,
kernel_cap_t *permitted)
const kernel_cap_t *effective,
const kernel_cap_t *inheritable,
const kernel_cap_t *permitted)
static int selinux_capget(const struct task_struct *target, kernel_cap_t *effective,
kernel_cap_t *inheritable, kernel_cap_t *permitted)
const kernel_cap_t *effective,
const kernel_cap_t *inheritable,
const kernel_cap_t *permitted)
kernel_cap_t cap_effective;
kernel_cap_t caps = cred->cap_effective;