apparmor/include/capability.h

0001 /* SPDX-License-Identifier: GPL-2.0-only */
0002 /*
0003  * AppArmor security module
0004  *
0005  * This file contains AppArmor capability mediation definitions.
0006  *
0007  * Copyright (C) 1998-2008 Novell/SUSE
0008  * Copyright 2009-2013 Canonical Ltd.
0009  */
0010
0011 #ifndef __AA_CAPABILITY_H
0012 #define __AA_CAPABILITY_H
0013
0014 #include <linux/sched.h>
0015
0016 #include "apparmorfs.h"
0017
0018 struct aa_label;
0019
0020 /* aa_caps - confinement data for capabilities
0021  * @allowed: capabilities mask
0022  * @audit: caps that are to be audited
0023  * @denied: caps that are explicitly denied
0024  * @quiet: caps that should not be audited
0025  * @kill: caps that when requested will result in the task being killed
0026  * @extended: caps that are subject finer grained mediation
0027  */
0028 struct aa_caps {
0029     kernel_cap_t allow;
0030     kernel_cap_t audit;
0031     kernel_cap_t denied;
0032     kernel_cap_t quiet;
0033     kernel_cap_t kill;
0034     kernel_cap_t extended;
0035 };
0036
0037 extern struct aa_sfs_entry aa_sfs_entry_caps[];
0038
0039 int aa_capable(struct aa_label *label, int cap, unsigned int opts);
0040
0041 static inline void aa_free_cap_rules(struct aa_caps *caps)
0042 {
0043     /* NOP */
0044 }
0045
0046 #endif /* __AA_CAPBILITY_H */