6f52b16c5b
Many user space API headers are missing licensing information, which makes it hard for compliance tools to determine the correct license. By default are files without license information under the default license of the kernel, which is GPLV2. Marking them GPLV2 would exclude them from being included in non GPLV2 code, which is obviously not intended. The user space API headers fall under the syscall exception which is in the kernels COPYING file: NOTE! This copyright does *not* cover user programs that use kernel services by normal system calls - this is merely considered normal use of the kernel, and does *not* fall under the heading of "derived work". otherwise syscall usage would not be possible. Update the files which contain no license information with an SPDX license identifier. The chosen identifier is 'GPL-2.0 WITH Linux-syscall-note' which is the officially assigned identifier for the Linux syscall exception. SPDX license identifiers are a legally binding shorthand, which can be used instead of the full boiler plate text. This patch is based on work done by Thomas Gleixner and Kate Stewart and Philippe Ombredanne. See the previous patch in this series for the methodology of how this patch was researched. Reviewed-by: Kate Stewart <kstewart@linuxfoundation.org> Reviewed-by: Philippe Ombredanne <pombredanne@nexb.com> Reviewed-by: Thomas Gleixner <tglx@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
62 lines
2.7 KiB
C
62 lines
2.7 KiB
C
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
|
|
#ifndef _UAPI_LINUX_SECUREBITS_H
|
|
#define _UAPI_LINUX_SECUREBITS_H
|
|
|
|
/* Each securesetting is implemented using two bits. One bit specifies
|
|
whether the setting is on or off. The other bit specify whether the
|
|
setting is locked or not. A setting which is locked cannot be
|
|
changed from user-level. */
|
|
#define issecure_mask(X) (1 << (X))
|
|
|
|
#define SECUREBITS_DEFAULT 0x00000000
|
|
|
|
/* When set UID 0 has no special privileges. When unset, we support
|
|
inheritance of root-permissions and suid-root executable under
|
|
compatibility mode. We raise the effective and inheritable bitmasks
|
|
*of the executable file* if the effective uid of the new process is
|
|
0. If the real uid is 0, we raise the effective (legacy) bit of the
|
|
executable file. */
|
|
#define SECURE_NOROOT 0
|
|
#define SECURE_NOROOT_LOCKED 1 /* make bit-0 immutable */
|
|
|
|
#define SECBIT_NOROOT (issecure_mask(SECURE_NOROOT))
|
|
#define SECBIT_NOROOT_LOCKED (issecure_mask(SECURE_NOROOT_LOCKED))
|
|
|
|
/* When set, setuid to/from uid 0 does not trigger capability-"fixup".
|
|
When unset, to provide compatiblility with old programs relying on
|
|
set*uid to gain/lose privilege, transitions to/from uid 0 cause
|
|
capabilities to be gained/lost. */
|
|
#define SECURE_NO_SETUID_FIXUP 2
|
|
#define SECURE_NO_SETUID_FIXUP_LOCKED 3 /* make bit-2 immutable */
|
|
|
|
#define SECBIT_NO_SETUID_FIXUP (issecure_mask(SECURE_NO_SETUID_FIXUP))
|
|
#define SECBIT_NO_SETUID_FIXUP_LOCKED \
|
|
(issecure_mask(SECURE_NO_SETUID_FIXUP_LOCKED))
|
|
|
|
/* When set, a process can retain its capabilities even after
|
|
transitioning to a non-root user (the set-uid fixup suppressed by
|
|
bit 2). Bit-4 is cleared when a process calls exec(); setting both
|
|
bit 4 and 5 will create a barrier through exec that no exec()'d
|
|
child can use this feature again. */
|
|
#define SECURE_KEEP_CAPS 4
|
|
#define SECURE_KEEP_CAPS_LOCKED 5 /* make bit-4 immutable */
|
|
|
|
#define SECBIT_KEEP_CAPS (issecure_mask(SECURE_KEEP_CAPS))
|
|
#define SECBIT_KEEP_CAPS_LOCKED (issecure_mask(SECURE_KEEP_CAPS_LOCKED))
|
|
|
|
/* When set, a process cannot add new capabilities to its ambient set. */
|
|
#define SECURE_NO_CAP_AMBIENT_RAISE 6
|
|
#define SECURE_NO_CAP_AMBIENT_RAISE_LOCKED 7 /* make bit-6 immutable */
|
|
|
|
#define SECBIT_NO_CAP_AMBIENT_RAISE (issecure_mask(SECURE_NO_CAP_AMBIENT_RAISE))
|
|
#define SECBIT_NO_CAP_AMBIENT_RAISE_LOCKED \
|
|
(issecure_mask(SECURE_NO_CAP_AMBIENT_RAISE_LOCKED))
|
|
|
|
#define SECURE_ALL_BITS (issecure_mask(SECURE_NOROOT) | \
|
|
issecure_mask(SECURE_NO_SETUID_FIXUP) | \
|
|
issecure_mask(SECURE_KEEP_CAPS) | \
|
|
issecure_mask(SECURE_NO_CAP_AMBIENT_RAISE))
|
|
#define SECURE_ALL_LOCKS (SECURE_ALL_BITS << 1)
|
|
|
|
#endif /* _UAPI_LINUX_SECUREBITS_H */
|