|
 |
c948b0 |
diff --color -ruN a/distcheck.sh b/distcheck.sh
|
|
|
c948b0 |
--- a/distcheck.sh 1970-01-01 01:00:00.000000000 +0100
|
|
|
c948b0 |
+++ b/distcheck.sh 2021-06-10 10:06:19.618284780 +0200
|
|
|
c948b0 |
@@ -0,0 +1,13 @@
|
|
|
c948b0 |
+#!/bin/bash
|
|
|
c948b0 |
+
|
|
|
c948b0 |
+actual=$(wget -o/dev/null -O/dev/stdout https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/plain/include/uapi/linux/capability.h | grep "#define.CAP_LAST_CAP"|awk '{print $3}')
|
|
|
c948b0 |
+working=$(grep "#define.CAP_LAST_CAP" libcap/include/uapi/linux/capability.h|awk '{print $3}')
|
|
|
c948b0 |
+
|
|
|
c948b0 |
+if [[ ${actual} = ${working} ]]; then
|
|
|
c948b0 |
+ echo "up to date with officially named caps"
|
|
|
c948b0 |
+ exit 0
|
|
|
c948b0 |
+fi
|
|
|
c948b0 |
+
|
|
|
c948b0 |
+echo "want: ${actual}"
|
|
|
c948b0 |
+echo "have: ${working}"
|
|
|
c948b0 |
+exit 1
|
|
|
c948b0 |
diff --color -ruN a/libcap/include/uapi/linux/capability.h b/libcap/include/uapi/linux/capability.h
|
|
|
c948b0 |
--- a/libcap/include/uapi/linux/capability.h 2018-09-09 20:06:40.000000000 +0200
|
|
|
c948b0 |
+++ b/libcap/include/uapi/linux/capability.h 2021-06-10 10:05:19.729202015 +0200
|
|
|
c948b0 |
@@ -331,6 +331,8 @@
|
|
|
c948b0 |
|
|
|
c948b0 |
#define CAP_AUDIT_CONTROL 30
|
|
|
c948b0 |
|
|
|
c948b0 |
+/* Set capabilities on files. */
|
|
|
c948b0 |
+
|
|
|
c948b0 |
#define CAP_SETFCAP 31
|
|
|
c948b0 |
|
|
|
c948b0 |
/* Override MAC access.
|
|
|
c948b0 |
@@ -366,8 +368,50 @@
|
|
|
c948b0 |
|
|
|
c948b0 |
#define CAP_AUDIT_READ 37
|
|
|
c948b0 |
|
|
|
c948b0 |
+/* Allow system performance and observability privileged operations using
|
|
|
c948b0 |
+ * perf_events, i915_perf and other kernel subsystems. */
|
|
|
c948b0 |
+
|
|
|
c948b0 |
+#define CAP_PERFMON 38
|
|
|
c948b0 |
+
|
|
|
c948b0 |
+/*
|
|
|
c948b0 |
+ * CAP_BPF allows the following BPF operations:
|
|
|
c948b0 |
+ * - Creating all types of BPF maps
|
|
|
c948b0 |
+ * - Advanced verifier features
|
|
|
c948b0 |
+ * - Indirect variable access
|
|
|
c948b0 |
+ * - Bounded loops
|
|
|
c948b0 |
+ * - BPF to BPF function calls
|
|
|
c948b0 |
+ * - Scalar precision tracking
|
|
|
c948b0 |
+ * - Larger complexity limits
|
|
|
c948b0 |
+ * - Dead code elimination
|
|
|
c948b0 |
+ * - And potentially other features
|
|
|
c948b0 |
+ * - Loading BPF Type Format (BTF) data
|
|
|
c948b0 |
+ * - Retrieve xlated and JITed code of BPF programs
|
|
|
c948b0 |
+ * - Use bpf_spin_lock() helper
|
|
|
c948b0 |
+ *
|
|
|
c948b0 |
+ * CAP_PERFMON relaxes the verifier checks further:
|
|
|
c948b0 |
+ * - BPF progs can use of pointer-to-integer conversions
|
|
|
c948b0 |
+ * - speculation attack hardening measures are bypassed
|
|
|
c948b0 |
+ * - bpf_probe_read to read arbitrary kernel memory is allowed
|
|
|
c948b0 |
+ * - bpf_trace_printk to print kernel memory is allowed
|
|
|
c948b0 |
+ *
|
|
|
c948b0 |
+ * CAP_SYS_ADMIN is required to use bpf_probe_write_user.
|
|
|
c948b0 |
+ *
|
|
|
c948b0 |
+ * CAP_SYS_ADMIN is required to iterate system wide loaded
|
|
|
c948b0 |
+ * programs, maps, links, BTFs and convert their IDs to file descriptors.
|
|
|
c948b0 |
+ *
|
|
|
c948b0 |
+ * CAP_PERFMON and CAP_BPF are required to load tracing programs.
|
|
|
c948b0 |
+ * CAP_NET_ADMIN and CAP_BPF are required to load networking programs.
|
|
|
c948b0 |
+ */
|
|
|
c948b0 |
+
|
|
|
c948b0 |
+#define CAP_BPF 39
|
|
|
c948b0 |
+
|
|
|
c948b0 |
+/* Allow checkpoint/restore related operations */
|
|
|
c948b0 |
+/* Allow PID selection during clone3() */
|
|
|
c948b0 |
+/* Allow writing to ns_last_pid */
|
|
|
c948b0 |
+
|
|
|
c948b0 |
+#define CAP_CHECKPOINT_RESTORE 40
|
|
|
c948b0 |
|
|
|
c948b0 |
-#define CAP_LAST_CAP CAP_AUDIT_READ
|
|
|
c948b0 |
+#define CAP_LAST_CAP CAP_CHECKPOINT_RESTORE
|
|
|
c948b0 |
|
|
|
c948b0 |
#define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP)
|
|
|
c948b0 |
|
|
|
c948b0 |
diff --color -ruN a/Makefile b/Makefile
|
|
|
c948b0 |
--- a/Makefile 2018-09-15 23:51:38.000000000 +0200
|
|
|
c948b0 |
+++ b/Makefile 2021-06-10 10:07:30.872573023 +0200
|
|
|
c948b0 |
@@ -33,7 +33,10 @@
|
|
|
c948b0 |
test: all
|
|
|
c948b0 |
cd progs && sudo ./quicktest.sh
|
|
|
c948b0 |
|
|
|
c948b0 |
-morganrelease: distclean
|
|
|
c948b0 |
+distcheck:
|
|
|
c948b0 |
+ ./distcheck.sh
|
|
|
c948b0 |
+
|
|
|
c948b0 |
+morganrelease: distclean distcheck
|
|
|
c948b0 |
@echo "sign the tag twice: older DSA key; and newer RSA kernel.org key"
|
|
|
c948b0 |
git tag -u D41A6DF2 -s libcap-$(VERSION).$(MINOR) -m "This is libcap-$(VERSION).$(MINOR)"
|
|
|
c948b0 |
git tag -u E2CCF3F4 -s libcap-korg-$(VERSION).$(MINOR) -m "This is libcap-$(VERSION).$(MINOR)"
|