parser: Move to a pre-generated cap_names.h

The auto-generated cap_names.h has problems when the parser if the
parser is built against a kernel with a smaller capability list than
the kernel policy is being compiled for.

Moving to a pre-generated list lets us support all capabilities even
when we build against older kernels. However we don't want to only use
the pre-generated list as that would make it too easy to miss when a
new capability has been added.

Keep auto generating the caps list and compare it to the pre-generated
caps list so we can detect when new capabilities are added, and fail
the build so that the pre-generated list can be updated. We screen the
diff for only additions so that the parser can continue to build on
older kernels that don't have the full capability list without errors.

Signed-off-by: John Johansen <john.johansen@canonical.com>

.gitignore

@@ -11,6 +11,7 @@ binutils/po/*.mo
 parser/po/*.mo
 parser/af_names.h
 parser/cap_names.h
+parser/generated_cap_names.h
 parser/tst_lib
 parser/tst_misc
 parser/tst_regex

parser/Makefile

@@ -285,9 +285,19 @@ af_names.h: ../common/list_af_names.sh
 	../common/list_af_names.sh | LC_ALL=C sed -n -e 's/AF_MAX[ \t]\+\([0-9]\+\),\?.*/\n#define AA_AF_MAX \1\n/p' >> $@
 	# cat $@
 
-cap_names.h: /usr/include/linux/capability.h
+generated_cap_names.h: /usr/include/linux/capability.h
 	../common/list_capabilities.sh | LC_ALL=C sed -n -e "s/[ \\t]\\?CAP_\\([A-Z0-9_]\\+\\)/\{\"\\L\\1\", \\UCAP_\\1\},\\n/pg" > $@
 
+cap_names.h: generated_cap_names.h base_cap_names.h
+	@ diff -u base_cap_names.h generated_cap_names.h | grep '^\+[^+]' ; \
+	if [ $$? -eq 1 ] ; then \
+		cp base_cap_names.h $@ ; \
+	else \
+		echo "Error: new capabilities detected please update base_cap_names.h with values from generated_cap_names.h" ; \
+		diff -u base_cap_names.h generated_cap_names.h ; \
+		exit 1; \
+	fi
+
 tst_lib: lib.c parser.h $(filter-out lib.o, ${TEST_OBJECTS})
 	$(CXX) $(TEST_CFLAGS) -o $@ $< $(filter-out $(<:.c=.o), ${TEST_OBJECTS}) $(TEST_LDFLAGS) $(TEST_LDLIBS)
 tst_%: parser_%.c parser.h $(filter-out parser_%.o, ${TEST_OBJECTS})
@@ -398,7 +408,7 @@ clean: pod_clean
 	rm -f parser_version.h
 	rm -f $(NAME)*.tar.gz $(NAME)*.tgz
 	rm -f af_names.h
-	rm -f cap_names.h
+	rm -f cap_names.h generated_cap_names.h
 	rm -rf techdoc.aux techdoc.out techdoc.log techdoc.pdf techdoc.toc techdoc.txt techdoc/
 	$(MAKE) -s -C $(AAREDIR) clean
 	$(MAKE) -s -C po clean

parser/base_cap_names.h

@@ -0,0 +1,80 @@
+{"audit_control", CAP_AUDIT_CONTROL},
+
+{"audit_read", CAP_AUDIT_READ},
+
+{"audit_write", CAP_AUDIT_WRITE},
+
+{"block_suspend", CAP_BLOCK_SUSPEND},
+
+{"bpf", CAP_BPF},
+
+{"chown", CAP_CHOWN},
+
+{"dac_override", CAP_DAC_OVERRIDE},
+
+{"dac_read_search", CAP_DAC_READ_SEARCH},
+
+{"fowner", CAP_FOWNER},
+
+{"fsetid", CAP_FSETID},
+
+{"ipc_lock", CAP_IPC_LOCK},
+
+{"ipc_owner", CAP_IPC_OWNER},
+
+{"kill", CAP_KILL},
+
+{"lease", CAP_LEASE},
+
+{"linux_immutable", CAP_LINUX_IMMUTABLE},
+
+{"mac_admin", CAP_MAC_ADMIN},
+
+{"mac_override", CAP_MAC_OVERRIDE},
+
+{"mknod", CAP_MKNOD},
+
+{"net_admin", CAP_NET_ADMIN},
+
+{"net_bind_service", CAP_NET_BIND_SERVICE},
+
+{"net_broadcast", CAP_NET_BROADCAST},
+
+{"net_raw", CAP_NET_RAW},
+
+{"perfmon", CAP_PERFMON},
+
+{"setfcap", CAP_SETFCAP},
+
+{"setgid", CAP_SETGID},
+
+{"setpcap", CAP_SETPCAP},
+
+{"setuid", CAP_SETUID},
+
+{"syslog", CAP_SYSLOG},
+
+{"sys_admin", CAP_SYS_ADMIN},
+
+{"sys_boot", CAP_SYS_BOOT},
+
+{"sys_chroot", CAP_SYS_CHROOT},
+
+{"sys_module", CAP_SYS_MODULE},
+
+{"sys_nice", CAP_SYS_NICE},
+
+{"sys_pacct", CAP_SYS_PACCT},
+
+{"sys_ptrace", CAP_SYS_PTRACE},
+
+{"sys_rawio", CAP_SYS_RAWIO},
+
+{"sys_resource", CAP_SYS_RESOURCE},
+
+{"sys_time", CAP_SYS_TIME},
+
+{"sys_tty_config", CAP_SYS_TTY_CONFIG},
+
+{"wake_alarm", CAP_WAKE_ALARM},
+

parser/default_features.c

@@ -142,7 +142,7 @@ signal {mask {hup int quit ill trap abrt bus fpe kill usr1 segv usr2 pipe alrm t
 ptrace {mask {read trace\
 }\
 }\
-caps {mask {chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read\
+caps {mask {chown dac_override dac_read_search fowner fsetid kill setgid setuid setpcap linux_immutable net_bind_service net_broadcast net_admin net_raw ipc_lock ipc_owner sys_module sys_rawio sys_chroot sys_ptrace sys_pacct sys_admin sys_boot sys_nice sys_resource sys_time sys_tty_config mknod lease audit_write audit_control setfcap mac_override mac_admin syslog wake_alarm block_suspend audit_read perfmon bpf\
 }\
 }\
 rlimit {mask {cpu fsize data stack core rss nproc nofile memlock as locks sigpending msgqueue nice rtprio rttime\

parser/parser_misc.c

@@ -165,6 +165,14 @@ static int get_table_token(const char *name unused, struct keyword_table *table,
 	return -1;
 }
 
+#ifndef CAP_PERFMON
+#define CAP_PERFMON 38
+#endif
+
+#ifndef CAP_BPF
+#define CAP_BPF 39
+#endif
+
 static struct keyword_table capability_table[] = {
 	/* capabilities */
 	#include "cap_names.h"