diff options
| author | Tushar Behera <tushar.behera@linaro.org> | 2012-03-26 16:54:15 +0530 |
|---|---|---|
| committer | Leo Wang <leozwang@google.com> | 2016-01-19 23:52:42 +0000 |
| commit | 94276a5059063eb0b138ebccb3e28157c4ed7d19 (patch) | |
| tree | c5b56522c8e88755e8ae90fd99c29d425df0acce | |
| parent | 3b29fd4bb91dd718fb0d67c99318b0d2f0c06c9f (diff) | |
| download | v4.1-94276a5059063eb0b138ebccb3e28157c4ed7d19.tar.gz | |
ANDROID: security: Add proper checks for Android specific capability checks
Commit b641072 ("security: Add AID_NET_RAW and AID_NET_ADMIN capability
check in cap_capable().") introduces additional checks for AID_NET_xxx
macros. Since the header file including those macros are conditionally
included, the checks should also be conditionally executed.
Change-Id: Iaec5208d5b95a46b1ac3f2db8449c661e803fa5b
Signed-off-by: Tushar Behera <tushar.behera@linaro.org>
Signed-off-by: Andrey Konovalov <andrey.konovalov@linaro.org>
Bug: 25923642
Patchset: rk3036 evb bring up
Cherry picked from android-3.18 branch.
(cherry picked from commit 13d423b1bfdaa74cdd61647eadd5430dcb820aae)
Signed-off-by: Jeffy Chen <jeffy.chen@rock-chips.com>
| -rw-r--r-- | security/commoncap.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/security/commoncap.c b/security/commoncap.c index 91f9086d1c6..de548914531 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -82,10 +82,12 @@ int cap_capable(const struct cred *cred, struct user_namespace *targ_ns, { struct user_namespace *ns = targ_ns; +#ifdef CONFIG_ANDROID_PARANOID_NETWORK if (cap == CAP_NET_RAW && in_egroup_p(AID_NET_RAW)) return 0; if (cap == CAP_NET_ADMIN && in_egroup_p(AID_NET_ADMIN)) return 0; +#endif /* See if cred has the capability in the target user namespace * by examining the target user namespace and all of the target |