cap2 0.1.0 → 0.1.1

data/ext/cap2/cap2.c

@@ -2,11 +2,12 @@
 #include <errno.h>
 #include <unistd.h>
 #include <sys/capability.h>
+#include "cap2.h"
 
 /*
  * Converts a Ruby symbol into cap_flag_t set, defined in <sys/capability.h>
  *
- * Raises an ArgumentError if set is not a valid capability set
+ * Raises an ArgumentError if set is not a valid capability set.
  */
 cap_flag_t cap2_sym_to_set(VALUE set) {
   char *set_s;
@@ -24,62 +25,36 @@ cap_flag_t cap2_sym_to_set(VALUE set) {
 }
 
 /*
- * Converts a Ruby symbol into cap_value_t capability value, defined
- * in <linux/capability.h>
+ * Lookup the value of a capability in cap2_caps, defined in cap2.h
+ * (cap2.h is generated dynamically by extconf.rb).
  *
- * Raises an ArgumentError if cap is not a valid capability value.
+ * Raises an ArgumentError if name is not a valid capability name.
  */
-cap_value_t cap2_sym_to_cap(VALUE cap) {
-  char *cap_s;
+cap_value_t cap2_cap_value(const char *name) {
+  int i;
+
+  for(i = 0; i < __CAP_COUNT; i++) {
+    if(strcmp(cap2_caps[i].name, name) == 0)
+      return cap2_caps[i].value;
+  }
+
+  rb_raise(rb_eArgError, "unknown capability %s", name);
+}
 
+/*
+ * Converts a Ruby symbol into a cap_value_t capability value.
+ */
+cap_value_t cap2_sym_to_cap(VALUE cap) {
   Check_Type(cap, T_SYMBOL);
 
   cap = rb_sym_to_s(cap);
 
-  cap_s = StringValueCStr(cap);
-
-       if(strcmp(cap_s, "chown")            == 0) return CAP_CHOWN;
-  else if(strcmp(cap_s, "dac_override")     == 0) return CAP_DAC_OVERRIDE;
-  else if(strcmp(cap_s, "dac_read_search")  == 0) return CAP_DAC_READ_SEARCH;
-  else if(strcmp(cap_s, "fowner")           == 0) return CAP_FOWNER;
-  else if(strcmp(cap_s, "fsetid")           == 0) return CAP_FSETID;
-  else if(strcmp(cap_s, "kill")             == 0) return CAP_KILL;
-  else if(strcmp(cap_s, "setgid")           == 0) return CAP_SETGID;
-  else if(strcmp(cap_s, "setuid")           == 0) return CAP_SETUID;
-  else if(strcmp(cap_s, "setpcap")          == 0) return CAP_SETPCAP;
-  else if(strcmp(cap_s, "linux_immutable")  == 0) return CAP_LINUX_IMMUTABLE;
-  else if(strcmp(cap_s, "net_bind_service") == 0) return CAP_NET_BIND_SERVICE;
-  else if(strcmp(cap_s, "net_broadcast")    == 0) return CAP_NET_BROADCAST;
-  else if(strcmp(cap_s, "net_admin")        == 0) return CAP_NET_ADMIN;
-  else if(strcmp(cap_s, "net_raw")          == 0) return CAP_NET_RAW;
-  else if(strcmp(cap_s, "ipc_lock")         == 0) return CAP_IPC_LOCK;
-  else if(strcmp(cap_s, "ipc_owner")        == 0) return CAP_IPC_OWNER;
-  else if(strcmp(cap_s, "sys_module")       == 0) return CAP_SYS_MODULE;
-  else if(strcmp(cap_s, "sys_rawio")        == 0) return CAP_SYS_RAWIO;
-  else if(strcmp(cap_s, "sys_chroot")       == 0) return CAP_SYS_CHROOT;
-  else if(strcmp(cap_s, "sys_ptrace")       == 0) return CAP_SYS_PTRACE;
-  else if(strcmp(cap_s, "sys_pacct")        == 0) return CAP_SYS_PACCT;
-  else if(strcmp(cap_s, "sys_admin")        == 0) return CAP_SYS_ADMIN;
-  else if(strcmp(cap_s, "sys_boot")         == 0) return CAP_SYS_BOOT;
-  else if(strcmp(cap_s, "sys_nice")         == 0) return CAP_SYS_NICE;
-  else if(strcmp(cap_s, "sys_resource")     == 0) return CAP_SYS_RESOURCE;
-  else if(strcmp(cap_s, "sys_time")         == 0) return CAP_SYS_TIME;
-  else if(strcmp(cap_s, "sys_tty_config")   == 0) return CAP_SYS_TTY_CONFIG;
-  else if(strcmp(cap_s, "mknod")            == 0) return CAP_MKNOD;
-  else if(strcmp(cap_s, "lease")            == 0) return CAP_LEASE;
-  else if(strcmp(cap_s, "audit_write")      == 0) return CAP_AUDIT_WRITE;
-  else if(strcmp(cap_s, "audit_control")    == 0) return CAP_AUDIT_CONTROL;
-  else if(strcmp(cap_s, "setfcap")          == 0) return CAP_SETFCAP;
-  else if(strcmp(cap_s, "mac_override")     == 0) return CAP_MAC_OVERRIDE;
-  else if(strcmp(cap_s, "mac_admin")        == 0) return CAP_MAC_ADMIN;
-  else if(strcmp(cap_s, "syslog")           == 0) return CAP_SYSLOG;
-  else if(strcmp(cap_s, "wake_alarm")       == 0) return CAP_WAKE_ALARM;
-  else rb_raise(rb_eArgError, "unknown capability %s", cap_s);
+  return cap2_cap_value(StringValueCStr(cap));
 }
 
 /*
  * Returns a boolean representing whether cap_d has the given capability enabled
- * in the given set
+ * in the given set.
  */
 VALUE cap2_has_cap(cap_t cap_d, VALUE set_sym, VALUE cap_sym) {
   cap_flag_t set;

data/ext/cap2/cap2.h

@@ -0,0 +1,43 @@
+struct {
+  int value;
+  char name[32];
+} cap2_caps[] = {
+  { 0, "chown" },
+  { 1, "dac_override" },
+  { 2, "dac_read_search" },
+  { 3, "fowner" },
+  { 4, "fsetid" },
+  { 5, "kill" },
+  { 6, "setgid" },
+  { 7, "setuid" },
+  { 8, "setpcap" },
+  { 9, "linux_immutable" },
+  { 10, "net_bind_service" },
+  { 11, "net_broadcast" },
+  { 12, "net_admin" },
+  { 13, "net_raw" },
+  { 14, "ipc_lock" },
+  { 15, "ipc_owner" },
+  { 16, "sys_module" },
+  { 17, "sys_rawio" },
+  { 18, "sys_chroot" },
+  { 19, "sys_ptrace" },
+  { 20, "sys_pacct" },
+  { 21, "sys_admin" },
+  { 22, "sys_boot" },
+  { 23, "sys_nice" },
+  { 24, "sys_resource" },
+  { 25, "sys_time" },
+  { 26, "sys_tty_config" },
+  { 27, "mknod" },
+  { 28, "lease" },
+  { 29, "audit_write" },
+  { 30, "audit_control" },
+  { 31, "setfcap" },
+  { 32, "mac_override" },
+  { 33, "mac_admin" },
+  { 34, "syslog" },
+  { 35, "wake_alarm" }
+};
+
+#define __CAP_COUNT 36

data/ext/cap2/extconf.rb

@@ -10,6 +10,31 @@ unless have_header('sys/capability.h')
   EOS
 end
 
+# Generate cap2.h dynamically to define cap2_caps, an array of capability
+# name / value pairs, with values as defined in <linux/capability.h>
+File.open(File.dirname(__FILE__) + '/cap2.h', 'w') do |file|
+  cap_count = 0
+  caps = []
+
+  File.
+    readlines('/usr/include/linux/capability.h').
+    grep(/#define CAP_([\w_]+)\s+(\d+)/) do
+      caps << %[{ #{$2}, "#{$1.downcase}" }]
+      cap_count += 1
+    end
+
+  file.puts <<-EOS
+struct {
+  int value;
+  char name[32];
+} cap2_caps[] = {
+  #{caps.join(",\n  ")}
+};
+
+#define __CAP_COUNT #{cap_count}
+EOS
+end
+
 unless have_library('cap')
   abort <<-EOS
   -----

data/lib/cap2/version.rb

@@ -1,3 +1,3 @@
 module Cap2
-  Version = '0.1.0'
+  Version = '0.1.1'
 end

data/spec/file_spec.rb

@@ -10,9 +10,9 @@ describe Cap2::File do
       it { should_not be_permitted(:dac_override) }
     end
 
-    context 'when the process does have the given capability' do
+    context 'when the file does have the given capability' do
       before(:each) do
-        system %{sudo setcap "cap_dac_override+p" #{file.path}}
+        run_as_root('permit(:dac_override)')
       end
 
       it { should be_permitted(:dac_override) }
@@ -24,9 +24,9 @@ describe Cap2::File do
       it { should_not be_effective(:dac_override) }
     end
 
-    context 'when the process does have the given capability' do
+    context 'when the file does have the given capability' do
       before(:each) do
-        system %{sudo setcap "cap_dac_override+pe" #{file.path}}
+        run_as_root('permit(:dac_override)', 'enable_on_exec(:dac_override)')
       end
 
       it { should be_effective(:dac_override) }
@@ -38,9 +38,9 @@ describe Cap2::File do
       it { should_not be_inheritable(:dac_override) }
     end
 
-    context 'when the process does have the given capability' do
+    context 'when the file does have the given capability' do
       before(:each) do
-        system %{sudo setcap "cap_dac_override+i" #{file.path}}
+        run_as_root('allow_inherit(:dac_override)')
       end
 
       it { should be_inheritable(:dac_override) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: cap2
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-08-30 00:00:00.000000000 Z
+date: 2012-09-02 00:00:00.000000000 Z
 dependencies: []
 description: ! "    Cap2 is a Ruby library for managing the POSIX 1003.1e capabilities\n
   \   available in Linux kernels.\n\n    These capabilities are a partitioning of
@@ -25,6 +25,7 @@ files:
 - README.md
 - Rakefile
 - LICENSE
+- ext/cap2/cap2.h
 - ext/cap2/extconf.rb
 - ext/cap2/cap2.c
 - lib/cap2.rb