Skip to content

Commit 62da8b9

Browse files
committed
linux: update securebits API for Linux 6.14
Linux 6.14 added two flags to SECURE_ALL_BITS, namely SECURE_EXEC_RESTRICT_FILE and SECURE_EXEC_DENY_INTERACTIVE.
1 parent 1abac21 commit 62da8b9

File tree

2 files changed

+20
-1
lines changed

2 files changed

+20
-1
lines changed

libc-test/semver/linux.txt

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2776,6 +2776,10 @@ SCTP_STATUS
27762776
SCTP_STREAM_RESET_INCOMING
27772777
SCTP_STREAM_RESET_OUTGOING
27782778
SCTP_UNORDERED
2779+
SECBIT_EXEC_DENY_INTERACTIVE
2780+
SECBIT_EXEC_DENY_INTERACTIVE_LOCKED
2781+
SECBIT_EXEC_RESTRICT_FILE
2782+
SECBIT_EXEC_RESTRICT_FILE_LOCKED
27792783
SECBIT_KEEP_CAPS
27802784
SECBIT_KEEP_CAPS_LOCKED
27812785
SECBIT_NOROOT

src/unix/linux_like/linux/mod.rs

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4750,9 +4750,24 @@ pub const SECBIT_NO_CAP_AMBIENT_RAISE: c_int = issecure_mask(SECURE_NO_CAP_AMBIE
47504750
pub const SECBIT_NO_CAP_AMBIENT_RAISE_LOCKED: c_int =
47514751
issecure_mask(SECURE_NO_CAP_AMBIENT_RAISE_LOCKED);
47524752

4753+
const SECURE_EXEC_RESTRICT_FILE: c_int = 8;
4754+
const SECURE_EXEC_RESTRICT_FILE_LOCKED: c_int = 9;
4755+
4756+
pub const SECBIT_EXEC_RESTRICT_FILE: c_int = issecure_mask(SECURE_EXEC_RESTRICT_FILE);
4757+
pub const SECBIT_EXEC_RESTRICT_FILE_LOCKED: c_int =
4758+
issecure_mask(SECURE_EXEC_RESTRICT_FILE_LOCKED);
4759+
4760+
const SECURE_EXEC_DENY_INTERACTIVE: c_int = 10;
4761+
const SECURE_EXEC_DENY_INTERACTIVE_LOCKED: c_int = 11;
4762+
4763+
pub const SECBIT_EXEC_DENY_INTERACTIVE: c_int = issecure_mask(SECURE_EXEC_DENY_INTERACTIVE);
4764+
pub const SECBIT_EXEC_DENY_INTERACTIVE_LOCKED: c_int =
4765+
issecure_mask(SECURE_EXEC_DENY_INTERACTIVE_LOCKED);
4766+
47534767
pub const SECUREBITS_DEFAULT: c_int = 0x00000000;
47544768
pub const SECURE_ALL_BITS: c_int =
4755-
SECBIT_NOROOT | SECBIT_NO_SETUID_FIXUP | SECBIT_KEEP_CAPS | SECBIT_NO_CAP_AMBIENT_RAISE;
4769+
SECBIT_NOROOT | SECBIT_NO_SETUID_FIXUP | SECBIT_KEEP_CAPS | SECBIT_NO_CAP_AMBIENT_RAISE |
4770+
SECBIT_EXEC_RESTRICT_FILE | SECBIT_EXEC_DENY_INTERACTIVE;
47564771
pub const SECURE_ALL_LOCKS: c_int = SECURE_ALL_BITS << 1;
47574772

47584773
const fn issecure_mask(x: c_int) -> c_int {

0 commit comments

Comments
 (0)