--- Andrew Morgan <[EMAIL PROTECTED]> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
>
> Casey Schaufler wrote:
> > diff -uprN -X linux-2.6.24-rc3-mm1-base/Documentation/dontdiff
> linux-2.6.24-rc3-mm1-base/include/linux/capability.h
> linux-2.6.24-rc3-mm1-smack/include/linux/capability.h
> > --- linux-2.6.24-rc3-mm1-base/include/linux/capability.h 2007-11-22
> 01:51:36.000000000 -0800
> > +++ linux-2.6.24-rc3-mm1-smack/include/linux/capability.h 2007-11-24
> 11:26:51.000000000 -0800
> > @@ -314,6 +314,23 @@ typedef struct kernel_cap_struct {
> >
> > #define CAP_SETFCAP 31
> >
> > +/* Override MAC access.
> > + The base kernel enforces no MAC policy.
> > + An LSM may enforce a MAC policy, and if it does and it chooses
> > + to implement capability based overrides of that policy, this is
> > + the capability it should use to do so. */
> > +
> > +#define CAP_MAC_OVERRIDE 32
> > +
> > +/* Allow MAC configuration or state changes.
> > + The base kernel requires no MAC configuration.
> > + An LSM may enforce a MAC policy, and if it does and it chooses
> > + to implement capability based checks on modifications to that
> > + policy or the data required to maintain it, this is the
> > + capability it should use to do so. */
> > +
> > +#define CAP_MAC_ADMIN 33
> > +
> > /*
> > * Bit location of each capability (used by user-space library and kernel)
> > */
> > @@ -334,7 +351,8 @@ typedef struct kernel_cap_struct {
> > | CAP_TO_MASK(CAP_DAC_OVERRIDE) \
> > | CAP_TO_MASK(CAP_DAC_READ_SEARCH) \
> > | CAP_TO_MASK(CAP_FOWNER) \
> > - | CAP_TO_MASK(CAP_FSETID))
> > + | CAP_TO_MASK(CAP_FSETID) \
>
> The following looks a bit fishy:
> > + | CAP_TO_MASK(CAP_MAC_OVERRIDE))
>
> (1<<32) & 0xffffffff == 0
>
> I think you need to define CAP_FS_MASK_B1.
I think you're right, and I'll need to use it, too.
Casey Schaufler
[EMAIL PROTECTED]
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
