1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * AppArmor security module 4 * 5 * This file contains AppArmor capability mediation definitions. 6 * 7 * Copyright (C) 1998-2008 Novell/SUSE 8 * Copyright 2009-2013 Canonical Ltd. 9 */ 10 11 #ifndef __AA_CAPABILITY_H 12 #define __AA_CAPABILITY_H 13 14 #include <linux/capability.h> 15 #include <linux/sched.h> 16 17 #include "apparmorfs.h" 18 19 struct aa_label; 20 21 /* aa_caps - confinement data for capabilities 22 * @allowed: capabilities mask 23 * @audit: caps that are to be audited 24 * @denied: caps that are explicitly denied 25 * @quiet: caps that should not be audited 26 * @kill: caps that when requested will result in the task being killed 27 * @extended: caps that are subject finer grained mediation 28 */ 29 struct aa_caps { 30 kernel_cap_t allow; 31 kernel_cap_t audit; 32 kernel_cap_t denied; 33 kernel_cap_t quiet; 34 kernel_cap_t kill; 35 kernel_cap_t extended; 36 }; 37 38 extern struct aa_sfs_entry aa_sfs_entry_caps[]; 39 40 kernel_cap_t aa_profile_capget(const struct aa_profile *profile); 41 int aa_capable(const struct cred *subj_cred, struct aa_label *label, 42 int cap, unsigned int opts); 43 aa_free_cap_rules(struct aa_caps * caps)44static inline void aa_free_cap_rules(struct aa_caps *caps) 45 { 46 /* NOP */ 47 } 48 49 #endif /* __AA_CAPBILITY_H */ 50