• Stephen Smalley's avatar
    selinux: keep SELinux in sync with new capability definitions · 3322d0d6
    Stephen Smalley authored
    When a new capability is defined, SELinux needs to be updated.
    Trigger a build error if a new capability is defined without
    corresponding update to security/selinux/include/classmap.h's
    COMMON_CAP2_PERMS.  This is similar to BUILD_BUG_ON() guards
    in the SELinux nlmsgtab code to ensure that SELinux tracks
    new netlink message types as needed.
    
    Note that there is already a similar build guard in
    security/selinux/hooks.c to detect when more than 64
    capabilities are defined, since that will require adding
    a third capability class to SELinux.
    
    A nicer way to do this would be to extend scripts/selinux/genheaders
    or a similar tool to auto-generate the necessary definitions and code
    for SELinux capability checking from include/uapi/linux/capability.h.
    AppArmor does something similar in its Makefile, although it only
    needs to generate a single table of names.  That is left as future
    work.
    Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
    [PM: reformat the description to keep checkpatch.pl happy]
    Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
    3322d0d6
classmap.h 5.8 KB