Track what capabilities are actually used and present the current
situation in /proc/self/status.
Signed-off-by: Topi Miettinen <toiwo...@gmail.com>
---
fs/exec.c | 1 +
fs/proc/array.c | 1 +
include/linux/sched.h | 1 +
kernel/capability.c | 1 +
4 files changed, 4 insertions(+)
diff --git a/fs/exec.c b/fs/exec.c
index 887c1c9..ff6f644 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1269,6 +1269,7 @@ void setup_new_exec(struct linux_binprm * bprm)
if (bprm->interp_flags & BINPRM_FLAGS_ENFORCE_NONDUMP)
set_dumpable(current->mm, suid_dumpable);
}
+ cap_clear(current->cap_used);
/* An exec changes our domain. We are no longer part of the thread
group */
diff --git a/fs/proc/array.c b/fs/proc/array.c
index 88c7de1..cccc9ee 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -343,6 +343,7 @@ static inline void task_cap(struct seq_file *m, struct
task_struct *p)
render_cap_t(m, "CapEff:\t", &cap_effective);
render_cap_t(m, "CapBnd:\t", &cap_bset);
render_cap_t(m, "CapAmb:\t", &cap_ambient);
+ render_cap_t(m, "CapUsd:\t", &p->cap_used);
}
static inline void task_seccomp(struct seq_file *m, struct task_struct *p)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 6e42ada..9c48a08 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1918,6 +1918,7 @@ struct task_struct {
#ifdef CONFIG_MMU
struct task_struct *oom_reaper_list;
#endif
+ kernel_cap_t cap_used; /* Capabilities actually used */
/* CPU-specific state of this task */
struct thread_struct thread;
/*
diff --git a/kernel/capability.c b/kernel/capability.c
index 45432b5..aad8854 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -380,6 +380,7 @@ bool ns_capable(struct user_namespace *ns, int cap)
}
if (security_capable(current_cred(), ns, cap) == 0) {
+ cap_raise(current->cap_used, cap);
current->flags |= PF_SUPERPRIV;
return true;
}
--
2.8.1
