[net-next-2.6.git] / include / linux / securebits.h

#ifndef _LINUX_SECUREBITS_H
#define _LINUX_SECUREBITS_H 1

/* Each securesetting is implemented using two bits. One bit specifies
   whether the setting is on or off. The other bit specify whether the
   setting is locked or not. A setting which is locked cannot be
   changed from user-level. */
#define issecure_mask(X)	(1 << (X))
#ifdef __KERNEL__
#define issecure(X)		(issecure_mask(X) & current_cred_xxx(securebits))
#endif

#define SECUREBITS_DEFAULT 0x00000000

/* When set UID 0 has no special privileges. When unset, we support
   inheritance of root-permissions and suid-root executable under
   compatibility mode. We raise the effective and inheritable bitmasks
   *of the executable file* if the effective uid of the new process is
   0. If the real uid is 0, we raise the effective (legacy) bit of the
   executable file. */
#define SECURE_NOROOT			0
#define SECURE_NOROOT_LOCKED		1  /* make bit-0 immutable */

#define SECBIT_NOROOT		(issecure_mask(SECURE_NOROOT))
#define SECBIT_NOROOT_LOCKED	(issecure_mask(SECURE_NOROOT_LOCKED))

/* When set, setuid to/from uid 0 does not trigger capability-"fixup".
   When unset, to provide compatiblility with old programs relying on
   set*uid to gain/lose privilege, transitions to/from uid 0 cause
   capabilities to be gained/lost. */
#define SECURE_NO_SETUID_FIXUP		2
#define SECURE_NO_SETUID_FIXUP_LOCKED	3  /* make bit-2 immutable */

#define SECBIT_NO_SETUID_FIXUP	(issecure_mask(SECURE_NO_SETUID_FIXUP))
#define SECBIT_NO_SETUID_FIXUP_LOCKED \
			(issecure_mask(SECURE_NO_SETUID_FIXUP_LOCKED))

/* When set, a process can retain its capabilities even after
   transitioning to a non-root user (the set-uid fixup suppressed by
   bit 2). Bit-4 is cleared when a process calls exec(); setting both
   bit 4 and 5 will create a barrier through exec that no exec()'d
   child can use this feature again. */
#define SECURE_KEEP_CAPS		4
#define SECURE_KEEP_CAPS_LOCKED		5  /* make bit-4 immutable */

#define SECBIT_KEEP_CAPS	(issecure_mask(SECURE_KEEP_CAPS))
#define SECBIT_KEEP_CAPS_LOCKED (issecure_mask(SECURE_KEEP_CAPS_LOCKED))

#define SECURE_ALL_BITS		(issecure_mask(SECURE_NOROOT) | \
				 issecure_mask(SECURE_NO_SETUID_FIXUP) | \
				 issecure_mask(SECURE_KEEP_CAPS))
#define SECURE_ALL_LOCKS	(SECURE_ALL_BITS << 1)

#endif /* !_LINUX_SECUREBITS_H */
Commit	Line	Data
1da177e4 LT	1	#ifndef _LINUX_SECUREBITS_H
	2	#define _LINUX_SECUREBITS_H 1
	3
5975c725 SH	4	/* Each securesetting is implemented using two bits. One bit specifies
	5	whether the setting is on or off. The other bit specify whether the
	6	setting is locked or not. A setting which is locked cannot be
	7	changed from user-level. */
	8	#define issecure_mask(X) (1 << (X))
	9	#ifdef __KERNEL__
	10	#define issecure(X) (issecure_mask(X) & current_cred_xxx(securebits))
	11	#endif
	12
1da177e4 LT	13	#define SECUREBITS_DEFAULT 0x00000000
1da177e4 LT	14
1da177e4 LT	15	/* When set UID 0 has no special privileges. When unset, we support
	16	inheritance of root-permissions and suid-root executable under
	17	compatibility mode. We raise the effective and inheritable bitmasks
	18	of the executable file if the effective uid of the new process is
086f7316	19	0. If the real uid is 0, we raise the effective (legacy) bit of the
1da177e4	20	executable file. */
3898b1b4 AM	21	#define SECURE_NOROOT 0
3898b1b4 AM	22	#define SECURE_NOROOT_LOCKED 1 /* make bit-0 immutable */
1da177e4	23
5975c725 SH	24	#define SECBIT_NOROOT (issecure_mask(SECURE_NOROOT))
	25	#define SECBIT_NOROOT_LOCKED (issecure_mask(SECURE_NOROOT_LOCKED))
	26
086f7316 AM	27	/* When set, setuid to/from uid 0 does not trigger capability-"fixup".
	28	When unset, to provide compatiblility with old programs relying on
	29	set*uid to gain/lose privilege, transitions to/from uid 0 cause
	30	capabilities to be gained/lost. */
3898b1b4 AM	31	#define SECURE_NO_SETUID_FIXUP 2
	32	#define SECURE_NO_SETUID_FIXUP_LOCKED 3 /* make bit-2 immutable */
	33
5975c725 SH	34	#define SECBIT_NO_SETUID_FIXUP (issecure_mask(SECURE_NO_SETUID_FIXUP))
	35	#define SECBIT_NO_SETUID_FIXUP_LOCKED \
	36	(issecure_mask(SECURE_NO_SETUID_FIXUP_LOCKED))
	37
3898b1b4 AM	38	/* When set, a process can retain its capabilities even after
	39	transitioning to a non-root user (the set-uid fixup suppressed by
	40	bit 2). Bit-4 is cleared when a process calls exec(); setting both
	41	bit 4 and 5 will create a barrier through exec that no exec()'d
	42	child can use this feature again. */
	43	#define SECURE_KEEP_CAPS 4
	44	#define SECURE_KEEP_CAPS_LOCKED 5 /* make bit-4 immutable */
1da177e4	45
5975c725 SH	46	#define SECBIT_KEEP_CAPS (issecure_mask(SECURE_KEEP_CAPS))
5975c725 SH	47	#define SECBIT_KEEP_CAPS_LOCKED (issecure_mask(SECURE_KEEP_CAPS_LOCKED))
1da177e4	48
3898b1b4 AM	49	#define SECURE_ALL_BITS (issecure_mask(SECURE_NOROOT) \| \
	50	issecure_mask(SECURE_NO_SETUID_FIXUP) \| \
	51	issecure_mask(SECURE_KEEP_CAPS))
	52	#define SECURE_ALL_LOCKS (SECURE_ALL_BITS << 1)
1da177e4 LT	53
1da177e4 LT	54	#endif /* !_LINUX_SECUREBITS_H */