1*4882a593Smuzhiyun /* SPDX-License-Identifier: GPL-2.0-only */ 2*4882a593Smuzhiyun /* 3*4882a593Smuzhiyun * AppArmor security module 4*4882a593Smuzhiyun * 5*4882a593Smuzhiyun * This file contains AppArmor capability mediation definitions. 6*4882a593Smuzhiyun * 7*4882a593Smuzhiyun * Copyright (C) 1998-2008 Novell/SUSE 8*4882a593Smuzhiyun * Copyright 2009-2013 Canonical Ltd. 9*4882a593Smuzhiyun */ 10*4882a593Smuzhiyun 11*4882a593Smuzhiyun #ifndef __AA_CAPABILITY_H 12*4882a593Smuzhiyun #define __AA_CAPABILITY_H 13*4882a593Smuzhiyun 14*4882a593Smuzhiyun #include <linux/sched.h> 15*4882a593Smuzhiyun 16*4882a593Smuzhiyun #include "apparmorfs.h" 17*4882a593Smuzhiyun 18*4882a593Smuzhiyun struct aa_label; 19*4882a593Smuzhiyun 20*4882a593Smuzhiyun /* aa_caps - confinement data for capabilities 21*4882a593Smuzhiyun * @allowed: capabilities mask 22*4882a593Smuzhiyun * @audit: caps that are to be audited 23*4882a593Smuzhiyun * @denied: caps that are explicitly denied 24*4882a593Smuzhiyun * @quiet: caps that should not be audited 25*4882a593Smuzhiyun * @kill: caps that when requested will result in the task being killed 26*4882a593Smuzhiyun * @extended: caps that are subject finer grained mediation 27*4882a593Smuzhiyun */ 28*4882a593Smuzhiyun struct aa_caps { 29*4882a593Smuzhiyun kernel_cap_t allow; 30*4882a593Smuzhiyun kernel_cap_t audit; 31*4882a593Smuzhiyun kernel_cap_t denied; 32*4882a593Smuzhiyun kernel_cap_t quiet; 33*4882a593Smuzhiyun kernel_cap_t kill; 34*4882a593Smuzhiyun kernel_cap_t extended; 35*4882a593Smuzhiyun }; 36*4882a593Smuzhiyun 37*4882a593Smuzhiyun extern struct aa_sfs_entry aa_sfs_entry_caps[]; 38*4882a593Smuzhiyun 39*4882a593Smuzhiyun int aa_capable(struct aa_label *label, int cap, unsigned int opts); 40*4882a593Smuzhiyun aa_free_cap_rules(struct aa_caps * caps)41*4882a593Smuzhiyunstatic inline void aa_free_cap_rules(struct aa_caps *caps) 42*4882a593Smuzhiyun { 43*4882a593Smuzhiyun /* NOP */ 44*4882a593Smuzhiyun } 45*4882a593Smuzhiyun 46*4882a593Smuzhiyun #endif /* __AA_CAPBILITY_H */ 47