1
2 #ifndef _UAPI_LINUX_SECUREBITS_H
3 #define _UAPI_LINUX_SECUREBITS_H
4
5
6
7
8
9 #define issecure_mask(X) (1 << (X))
10
11 #define SECUREBITS_DEFAULT 0x00000000
12
13
14
15
16
17
18
19 #define SECURE_NOROOT 0
20 #define SECURE_NOROOT_LOCKED 1
21
22 #define SECBIT_NOROOT (issecure_mask(SECURE_NOROOT))
23 #define SECBIT_NOROOT_LOCKED (issecure_mask(SECURE_NOROOT_LOCKED))
24
25
26
27
28
29 #define SECURE_NO_SETUID_FIXUP 2
30 #define SECURE_NO_SETUID_FIXUP_LOCKED 3
31
32 #define SECBIT_NO_SETUID_FIXUP (issecure_mask(SECURE_NO_SETUID_FIXUP))
33 #define SECBIT_NO_SETUID_FIXUP_LOCKED \
34 (issecure_mask(SECURE_NO_SETUID_FIXUP_LOCKED))
35
36
37
38
39
40
41 #define SECURE_KEEP_CAPS 4
42 #define SECURE_KEEP_CAPS_LOCKED 5
43
44 #define SECBIT_KEEP_CAPS (issecure_mask(SECURE_KEEP_CAPS))
45 #define SECBIT_KEEP_CAPS_LOCKED (issecure_mask(SECURE_KEEP_CAPS_LOCKED))
46
47
48 #define SECURE_NO_CAP_AMBIENT_RAISE 6
49 #define SECURE_NO_CAP_AMBIENT_RAISE_LOCKED 7
50
51 #define SECBIT_NO_CAP_AMBIENT_RAISE (issecure_mask(SECURE_NO_CAP_AMBIENT_RAISE))
52 #define SECBIT_NO_CAP_AMBIENT_RAISE_LOCKED \
53 (issecure_mask(SECURE_NO_CAP_AMBIENT_RAISE_LOCKED))
54
55 #define SECURE_ALL_BITS (issecure_mask(SECURE_NOROOT) | \
56 issecure_mask(SECURE_NO_SETUID_FIXUP) | \
57 issecure_mask(SECURE_KEEP_CAPS) | \
58 issecure_mask(SECURE_NO_CAP_AMBIENT_RAISE))
59 #define SECURE_ALL_LOCKS (SECURE_ALL_BITS << 1)
60
61 #endif