From 0bc0fb42ba3ae1786c94f656a80c1b6c0f4c00c0 Mon Sep 17 00:00:00 2001 From: Chris Wailes Date: Fri, 6 Jun 2025 15:01:48 -0700 Subject: [PATCH] Add SECBIT_ constants from securebits.h See: https://github.com/torvalds/linux/blob/master/include/uapi/linux/securebits.h --- src/unix/linux_like/linux/mod.rs | 20 ++++++++++++++++++++ src/unix/linux_like/android/mod.rs | 20 ++++++++++++++++++++ 2 files changed, 40 insertions(+) diff --git a/src/unix/linux_like/linux/mod.rs b/src/unix/linux_like/linux/mod.rs index 258bf9c08..77a93bb2c 100644 --- a/src/unix/linux_like/linux/mod.rs +++ b/src/unix/linux_like/linux/mod.rs @@ -4815,6 +4815,26 @@ pub const IN_ONLYDIR: u32 = 0x0100_0000; pub const IN_DONT_FOLLOW: u32 = 0x0200_0000; pub const IN_EXCL_UNLINK: u32 = 0x0400_0000; +// uapi/linux/securebits.h +pub const SECBIT_NOROOT: c_int = 1 << 0; +pub const SECBIT_NOROOT_LOCKED: c_int = 1 << 1; + +pub const SECBIT_NO_SETUID_FIXUP: c_int = 1 << 2; +pub const SECBIT_NO_SETUID_FIXUP_LOCKED: c_int = 1 << 3; + +pub const SECBIT_KEEP_CAPS: c_int = 1 << 4; +pub const SECBIT_KEEP_CAPS_LOCKED: c_int = 1 << 5; + +pub const SECBIT_NO_CAP_AMBIENT_RAISE: c_int = 1 << 6; +pub const SECBIT_NO_CAP_AMBIENT_RAISE_LOCKED: c_int = 1 << 7; + +pub const SECUREBITS_DEFAULT: c_int = 0x00000000; +pub const SECURE_ALL_BITS: c_int = SECBIT_NOROOT + | SECBIT_NO_SETUID_FIXUP + | SECBIT_KEEP_CAPS + | SECBIT_NO_CAP_AMBIENT_RAISE; +pub const SECURE_ALL_LOCKS: c_int = SECURE_ALL_BITS << 1; + // linux/keyctl.h pub const KEY_SPEC_THREAD_KEYRING: i32 = -1; pub const KEY_SPEC_PROCESS_KEYRING: i32 = -2; diff --git a/crates/libc/src/unix/linux_like/android/mod.rs b/crates/libc/src/unix/linux_like/android/mod.rs index abbfecb6..4bdfe993 100644 --- a/src/unix/linux_like/android/mod.rs +++ b/src/unix/linux_like/android/mod.rs @@ -3032,6 +3032,26 @@ pub const FUTEX_PRIVATE_FLAG: c_int = 128; pub const FUTEX_CLOCK_REALTIME: c_int = 256; pub const FUTEX_CMD_MASK: c_int = !(FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME); +// uapi/linux/securebits.h +pub const SECBIT_NOROOT: c_int = 1 << 0; +pub const SECBIT_NOROOT_LOCKED: c_int = 1 << 1; + +pub const SECBIT_NO_SETUID_FIXUP: c_int = 1 << 2; +pub const SECBIT_NO_SETUID_FIXUP_LOCKED: c_int = 1 << 3; + +pub const SECBIT_KEEP_CAPS: c_int = 1 << 4; +pub const SECBIT_KEEP_CAPS_LOCKED: c_int = 1 << 5; + +pub const SECBIT_NO_CAP_AMBIENT_RAISE: c_int = 1 << 6; +pub const SECBIT_NO_CAP_AMBIENT_RAISE_LOCKED: c_int = 1 << 7; + +pub const SECUREBITS_DEFAULT: c_int = 0x00000000; +pub const SECURE_ALL_BITS: c_int = SECBIT_NOROOT + | SECBIT_NO_SETUID_FIXUP + | SECBIT_KEEP_CAPS + | SECBIT_NO_CAP_AMBIENT_RAISE; +pub const SECURE_ALL_LOCKS: c_int = SECURE_ALL_BITS << 1; + // linux/errqueue.h pub const SO_EE_ORIGIN_NONE: u8 = 0; pub const SO_EE_ORIGIN_LOCAL: u8 = 1; -- 2.50.0.rc1.591.g9c95f17f64-goog