Add CONFIG_ANDROID_PARANOID_NETWORK for Android specific capabilities
Change-Id: Ic9a44e4f754445fbf59a52e5aa75a2d8e3d0930f
Signed-off-by: Preetham Chandru R <pchandru@nvidia.com>
Reviewed-on: http://git-master/r/97519
Reviewed-by: Sanjay Singh Rawat <srawat@nvidia.com>
Reviewed-by: Kiran Adduri <kadduri@nvidia.com>
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>
int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
int cap, int audit)
{
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
if (cap == CAP_NET_RAW && in_egroup_p(AID_NET_RAW))
return 0;
if (cap == CAP_NET_ADMIN && in_egroup_p(AID_NET_ADMIN))
return 0;
-
+#endif
for (;;) {
/* The creator of the user namespace has all caps. */
if (targ_ns != &init_user_ns && targ_ns->creator == cred->user)