Return to capabilities.h CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libstrongswan / utils

Annotation of embedaddon/strongswan/src/libstrongswan/utils/capabilities.h, revision 1.1.1.1

1.1       misho       1: /*
                      2:  * Copyright (C) 2013 Tobias Brunner
                      3:  * HSR Hochschule fuer Technik Rapperswil
                      4:  * Copyright (C) 2012 Martin Willi
                      5:  * Copyright (C) 2012 revosec AG
                      6:  *
                      7:  * This program is free software; you can redistribute it and/or modify it
                      8:  * under the terms of the GNU General Public License as published by the
                      9:  * Free Software Foundation; either version 2 of the License, or (at your
                     10:  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
                     11:  *
                     12:  * This program is distributed in the hope that it will be useful, but
                     13:  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
                     14:  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
                     15:  * for more details.
                     16:  */
                     17: 
                     18: /**
                     19:  * @defgroup capabilities capabilities
                     20:  * @{ @ingroup utils
                     21:  */
                     22: 
                     23: #ifndef CAPABILITIES_H_
                     24: #define CAPABILITIES_H_
                     25: 
                     26: typedef struct capabilities_t capabilities_t;
                     27: 
                     28: #include <library.h>
                     29: #ifdef HAVE_SYS_CAPABILITY_H
                     30: # include <sys/capability.h>
                     31: #elif defined(CAPABILITIES_NATIVE)
                     32: # include <linux/capability.h>
                     33: #endif
                     34: 
                     35: #ifndef CAP_CHOWN
                     36: # define CAP_CHOWN 0
                     37: #endif
                     38: #ifndef CAP_NET_BIND_SERVICE
                     39: # define CAP_NET_BIND_SERVICE 10
                     40: #endif
                     41: #ifndef CAP_NET_ADMIN
                     42: # define CAP_NET_ADMIN 12
                     43: #endif
                     44: #ifndef CAP_NET_RAW
                     45: # define CAP_NET_RAW 13
                     46: #endif
                     47: #ifndef CAP_DAC_OVERRIDE
                     48: # define CAP_DAC_OVERRIDE 1
                     49: #endif
                     50: #ifndef CAP_SETPCAP
                     51: # define CAP_SETPCAP 8
                     52: #endif
                     53: 
                     54: /**
                     55:  * POSIX capability dropping abstraction layer.
                     56:  */
                     57: struct capabilities_t {
                     58: 
                     59:        /**
                     60:         * Register a capability to keep while calling drop(). Verifies that the
                     61:         * capability is currently held.
                     62:         *
                     63:         * @note CAP_CHOWN is handled specially as it might not be required.
                     64:         *
                     65:         * @param cap           capability to keep
                     66:         * @return                      FALSE if the capability is currently not held
                     67:         */
                     68:        bool (*keep)(capabilities_t *this,
                     69:                                 u_int cap) __attribute__((warn_unused_result));
                     70: 
                     71:        /**
                     72:         * Check if the given capability is currently held.
                     73:         *
                     74:         * @note CAP_CHOWN is handled specially as it might not be required.
                     75:         *
                     76:         * @param cap           capability to check
                     77:         * @return                      TRUE if the capability is currently held
                     78:         */
                     79:        bool (*check)(capabilities_t *this, u_int cap);
                     80: 
                     81:        /**
                     82:         * Get the user ID set through set_uid/resolve_uid.
                     83:         *
                     84:         * @return                      currently set user ID
                     85:         */
                     86:        uid_t (*get_uid)(capabilities_t *this);
                     87: 
                     88:        /**
                     89:         * Get the group ID set through set_gid/resolve_gid.
                     90:         *
                     91:         * @return                      currently set group ID
                     92:         */
                     93:        gid_t (*get_gid)(capabilities_t *this);
                     94: 
                     95:        /**
                     96:         * Set the numerical user ID to use during rights dropping.
                     97:         *
                     98:         * @param uid           user ID to use
                     99:         */
                    100:        void (*set_uid)(capabilities_t *this, uid_t uid);
                    101: 
                    102:        /**
                    103:         * Set the numerical group ID to use during rights dropping.
                    104:         *
                    105:         * @param gid           group ID to use
                    106:         */
                    107:        void (*set_gid)(capabilities_t *this, gid_t gid);
                    108: 
                    109:        /**
                    110:         * Resolve a username and set the user ID accordingly.
                    111:         *
                    112:         * @param username      username get the uid for
                    113:         * @return                      TRUE if username resolved and uid set
                    114:         */
                    115:        bool (*resolve_uid)(capabilities_t *this, char *username);
                    116: 
                    117:        /**
                    118:         * Resolve a groupname and set the group ID accordingly.
                    119:         *
                    120:         * @param groupname     groupname to get the gid for
                    121:         * @return                      TRUE if groupname resolved and gid set
                    122:         */
                    123:        bool (*resolve_gid)(capabilities_t *this, char *groupname);
                    124: 
                    125:        /**
                    126:         * Drop all capabilities not previously passed to keep(), switch to UID/GID.
                    127:         *
                    128:         * @return                      TRUE if capability drop successful
                    129:         */
                    130:        bool (*drop)(capabilities_t *this);
                    131: 
                    132:        /**
                    133:         * Destroy a capabilities_t.
                    134:         */
                    135:        void (*destroy)(capabilities_t *this);
                    136: };
                    137: 
                    138: /**
                    139:  * Create a capabilities instance.
                    140:  */
                    141: capabilities_t *capabilities_create();
                    142: 
                    143: #endif /** CAPABILITIES_H_ @}*/