security: Add config flag for Android specific caps
Preetham Chandru [Wed, 18 Apr 2012 13:57:16 +0000 (18:57 +0530)]
Add CONFIG_ANDROID_PARANOID_NETWORK for Android specific capabilities

Change-Id: Ic9a44e4f754445fbf59a52e5aa75a2d8e3d0930f
Signed-off-by: Preetham Chandru R <pchandru@nvidia.com>
Reviewed-on: http://git-master/r/97519
Reviewed-by: Sanjay Singh Rawat <srawat@nvidia.com>
Reviewed-by: Kiran Adduri <kadduri@nvidia.com>
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

security/commoncap.c

index 5cbb55e..2b07d91 100644 (file)
@@ -79,11 +79,12 @@ int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
 int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
                int cap, int audit)
 {
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
        if (cap == CAP_NET_RAW && in_egroup_p(AID_NET_RAW))
                return 0;
        if (cap == CAP_NET_ADMIN && in_egroup_p(AID_NET_ADMIN))
                return 0;
-
+#endif
        for (;;) {
                /* The creator of the user namespace has all caps. */
                if (targ_ns != &init_user_ns && targ_ns->creator == cred->user)