[PATCH 1/3] remove empty build of capability.o

[PATCH 1/3] remove empty build of capability.o

[Chris Wright]

The build includes capability.c when CONFIG_SECURITY=n, yet the whole file
is ifdef'd out.  Remove unnecessary build step as well as superfluous ifdefs.

--- linus-2.5/security/capability.c~ifdef	2004-05-11 14:55:19.000000000 -0700
+++ linus-2.5/security/capability.c	2004-05-11 15:00:28.000000000 -0700
@@ -23,9 +23,6 @@
 #include <linux/netlink.h>
 #include <linux/ptrace.h>
 
-#ifdef CONFIG_SECURITY
-
-
 static struct security_operations capability_ops = {
 	.ptrace =			cap_ptrace,
 	.capget =			cap_capget,
@@ -99,5 +96,3 @@
 
 MODULE_DESCRIPTION("Standard Linux Capabilities Security Module");
 MODULE_LICENSE("GPL");
-
-#endif	/* CONFIG_SECURITY */
--- linus-2.5/security/Makefile~ifdef	2004-05-11 14:58:06.000000000 -0700
+++ linus-2.5/security/Makefile	2004-05-11 14:58:16.000000000 -0700
@@ -6,7 +6,7 @@
 
 # if we don't select a security model, use the default capabilities
 ifneq ($(CONFIG_SECURITY),y)
-obj-y		+= commoncap.o capability.o
+obj-y		+= commoncap.o
 endif
 
 # Object file lists

[PATCH 2/3] minor cleanups in capability.c

[Chris Wright]

Remove confusing error message when loading as secondary module, and
ditch conditional MY_NAME macro.

--- linus-2.5/security/capability.c~verbose	2004-05-11 15:44:11.651038464 -0700
+++ linus-2.5/security/capability.c	2004-05-11 16:02:25.144802144 -0700
@@ -47,11 +47,7 @@
 	.vm_enough_memory =             cap_vm_enough_memory,
 };
 
-#if defined(CONFIG_SECURITY_CAPABILITIES_MODULE)
-#define MY_NAME THIS_MODULE->name
-#else
-#define MY_NAME "capability"
-#endif
+#define MY_NAME __stringify(KBUILD_MODNAME)
 
 /* flag to keep track of how we were registered */
 static int secondary;
@@ -61,8 +57,6 @@
 {
 	/* register ourselves with the security framework */
 	if (register_security (&capability_ops)) {
-		printk (KERN_INFO
-			"Failure registering capabilities with the kernel\n");
 		/* try registering with primary module */
 		if (mod_reg_security (MY_NAME, &capability_ops)) {
 			printk (KERN_INFO "Failure registering capabilities "
@@ -71,7 +65,8 @@
 		}
 		secondary = 1;
 	}
-	printk (KERN_INFO "Capability LSM initialized\n");
+	printk (KERN_INFO "Capability LSM initialized%s\n",
+		secondary ? " as secondary" : "");
 	return 0;
 }
 

[PATCH 3/3] add disable param to capabilities module

[Chris Wright]

Add disable param to capabilities module.  Similar to the SELinux param
for disabling at boot time.  This allows vendors to ship single binary
image with capabilities compiled statically, and disable it if they
provide another security model compiled as module.

--- linus-2.5/security/capability.c~disable	2004-05-11 16:14:36.121676768 -0700
+++ linus-2.5/security/capability.c	2004-05-11 16:19:25.906622760 -0700
@@ -22,6 +22,7 @@
 #include <linux/skbuff.h>
 #include <linux/netlink.h>
 #include <linux/ptrace.h>
+#include <linux/moduleparam.h>
 
 static struct security_operations capability_ops = {
 	.ptrace =			cap_ptrace,
@@ -52,9 +53,16 @@
 /* flag to keep track of how we were registered */
 static int secondary;
 
+static int capability_disable;
+module_param_named(disable, capability_disable, int, 0);
+MODULE_PARM_DESC(disable, "To disable capabilities module set disable = 1");
 
 static int __init capability_init (void)
 {
+	if (capability_disable) {
+		printk(KERN_INFO "Capabilities disabled at initialization\n");
+		return 0;
+	}
 	/* register ourselves with the security framework */
 	if (register_security (&capability_ops)) {
 		/* try registering with primary module */
@@ -72,6 +80,8 @@
 
 static void __exit capability_exit (void)
 {
+	if (capability_disable)
+		return;
 	/* remove ourselves from the security framework */
 	if (secondary) {
 		if (mod_unreg_security (MY_NAME, &capability_ops))