kernel: conditionally support non-root users, groups and capabilities
authorIulia Manda <iulia.manda21@gmail.com>
Wed, 15 Apr 2015 23:16:41 +0000 (16:16 -0700)
committerLinus Torvalds <torvalds@linux-foundation.org>
Wed, 15 Apr 2015 23:35:22 +0000 (16:35 -0700)
commit2813893f8b197a14f1e1ddb04d99bce46817c84a
tree650651e638f867a6bda23e08c70bdd9857d121ca
parentc79574abe2baddf569532e7e430e4977771dd25c
kernel: conditionally support non-root users, groups and capabilities

There are a lot of embedded systems that run most or all of their
functionality in init, running as root:root.  For these systems,
supporting multiple users is not necessary.

This patch adds a new symbol, CONFIG_MULTIUSER, that makes support for
non-root users, non-root groups, and capabilities optional.  It is enabled
under CONFIG_EXPERT menu.

When this symbol is not defined, UID and GID are zero in any possible case
and processes always have all capabilities.

The following syscalls are compiled out: setuid, setregid, setgid,
setreuid, setresuid, getresuid, setresgid, getresgid, setgroups,
getgroups, setfsuid, setfsgid, capget, capset.

Also, groups.c is compiled out completely.

In kernel/capability.c, capable function was moved in order to avoid
adding two ifdef blocks.

This change saves about 25 KB on a defconfig build.  The most minimal
kernels have total text sizes in the high hundreds of kB rather than
low MB.  (The 25k goes down a bit with allnoconfig, but not that much.

The kernel was booted in Qemu.  All the common functionalities work.
Adding users/groups is not possible, failing with -ENOSYS.

Bloat-o-meter output:
add/remove: 7/87 grow/shrink: 19/397 up/down: 1675/-26325 (-24650)

[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: Iulia Manda <iulia.manda21@gmail.com>
Reviewed-by: Josh Triplett <josh@joshtriplett.org>
Acked-by: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Reviewed-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
16 files changed:
arch/s390/Kconfig
drivers/staging/lustre/lustre/Kconfig
fs/nfs/Kconfig
fs/nfsd/Kconfig
include/linux/capability.h
include/linux/cred.h
include/linux/uidgid.h
init/Kconfig
kernel/Makefile
kernel/capability.c
kernel/cred.c
kernel/groups.c
kernel/sys.c
kernel/sys_ni.c
net/sunrpc/Kconfig
security/Kconfig