commoncap.c 40 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* Common capabilities, needed by capability.o.
  3. */
  4. #include <linux/capability.h>
  5. #include <linux/audit.h>
  6. #include <linux/init.h>
  7. #include <linux/kernel.h>
  8. #include <linux/lsm_hooks.h>
  9. #include <linux/file.h>
  10. #include <linux/mm.h>
  11. #include <linux/mman.h>
  12. #include <linux/pagemap.h>
  13. #include <linux/swap.h>
  14. #include <linux/skbuff.h>
  15. #include <linux/netlink.h>
  16. #include <linux/ptrace.h>
  17. #include <linux/xattr.h>
  18. #include <linux/hugetlb.h>
  19. #include <linux/mount.h>
  20. #include <linux/sched.h>
  21. #include <linux/prctl.h>
  22. #include <linux/securebits.h>
  23. #include <linux/user_namespace.h>
  24. #include <linux/binfmts.h>
  25. #include <linux/personality.h>
  26. /*
  27. * If a non-root user executes a setuid-root binary in
  28. * !secure(SECURE_NOROOT) mode, then we raise capabilities.
  29. * However if fE is also set, then the intent is for only
  30. * the file capabilities to be applied, and the setuid-root
  31. * bit is left on either to change the uid (plausible) or
  32. * to get full privilege on a kernel without file capabilities
  33. * support. So in that case we do not raise capabilities.
  34. *
  35. * Warn if that happens, once per boot.
  36. */
  37. static void warn_setuid_and_fcaps_mixed(const char *fname)
  38. {
  39. static int warned;
  40. if (!warned) {
  41. printk(KERN_INFO "warning: `%s' has both setuid-root and"
  42. " effective capabilities. Therefore not raising all"
  43. " capabilities.\n", fname);
  44. warned = 1;
  45. }
  46. }
  47. /**
  48. * cap_capable - Determine whether a task has a particular effective capability
  49. * @cred: The credentials to use
  50. * @ns: The user namespace in which we need the capability
  51. * @cap: The capability to check for
  52. * @opts: Bitmask of options defined in include/linux/security.h
  53. *
  54. * Determine whether the nominated task has the specified capability amongst
  55. * its effective set, returning 0 if it does, -ve if it does not.
  56. *
  57. * NOTE WELL: cap_has_capability() cannot be used like the kernel's capable()
  58. * and has_capability() functions. That is, it has the reverse semantics:
  59. * cap_has_capability() returns 0 when a task has a capability, but the
  60. * kernel's capable() and has_capability() returns 1 for this case.
  61. */
  62. int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
  63. int cap, unsigned int opts)
  64. {
  65. struct user_namespace *ns = targ_ns;
  66. /* See if cred has the capability in the target user namespace
  67. * by examining the target user namespace and all of the target
  68. * user namespace's parents.
  69. */
  70. for (;;) {
  71. /* Do we have the necessary capabilities? */
  72. if (ns == cred->user_ns)
  73. return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
  74. /*
  75. * If we're already at a lower level than we're looking for,
  76. * we're done searching.
  77. */
  78. if (ns->level <= cred->user_ns->level)
  79. return -EPERM;
  80. /*
  81. * The owner of the user namespace in the parent of the
  82. * user namespace has all caps.
  83. */
  84. if ((ns->parent == cred->user_ns) && uid_eq(ns->owner, cred->euid))
  85. return 0;
  86. /*
  87. * If you have a capability in a parent user ns, then you have
  88. * it over all children user namespaces as well.
  89. */
  90. ns = ns->parent;
  91. }
  92. /* We never get here */
  93. }
  94. /**
  95. * cap_settime - Determine whether the current process may set the system clock
  96. * @ts: The time to set
  97. * @tz: The timezone to set
  98. *
  99. * Determine whether the current process may set the system clock and timezone
  100. * information, returning 0 if permission granted, -ve if denied.
  101. */
  102. int cap_settime(const struct timespec64 *ts, const struct timezone *tz)
  103. {
  104. if (!capable(CAP_SYS_TIME))
  105. return -EPERM;
  106. return 0;
  107. }
  108. /**
  109. * cap_ptrace_access_check - Determine whether the current process may access
  110. * another
  111. * @child: The process to be accessed
  112. * @mode: The mode of attachment.
  113. *
  114. * If we are in the same or an ancestor user_ns and have all the target
  115. * task's capabilities, then ptrace access is allowed.
  116. * If we have the ptrace capability to the target user_ns, then ptrace
  117. * access is allowed.
  118. * Else denied.
  119. *
  120. * Determine whether a process may access another, returning 0 if permission
  121. * granted, -ve if denied.
  122. */
  123. int cap_ptrace_access_check(struct task_struct *child, unsigned int mode)
  124. {
  125. int ret = 0;
  126. const struct cred *cred, *child_cred;
  127. const kernel_cap_t *caller_caps;
  128. rcu_read_lock();
  129. cred = current_cred();
  130. child_cred = __task_cred(child);
  131. if (mode & PTRACE_MODE_FSCREDS)
  132. caller_caps = &cred->cap_effective;
  133. else
  134. caller_caps = &cred->cap_permitted;
  135. if (cred->user_ns == child_cred->user_ns &&
  136. cap_issubset(child_cred->cap_permitted, *caller_caps))
  137. goto out;
  138. if (ns_capable(child_cred->user_ns, CAP_SYS_PTRACE))
  139. goto out;
  140. ret = -EPERM;
  141. out:
  142. rcu_read_unlock();
  143. return ret;
  144. }
  145. /**
  146. * cap_ptrace_traceme - Determine whether another process may trace the current
  147. * @parent: The task proposed to be the tracer
  148. *
  149. * If parent is in the same or an ancestor user_ns and has all current's
  150. * capabilities, then ptrace access is allowed.
  151. * If parent has the ptrace capability to current's user_ns, then ptrace
  152. * access is allowed.
  153. * Else denied.
  154. *
  155. * Determine whether the nominated task is permitted to trace the current
  156. * process, returning 0 if permission is granted, -ve if denied.
  157. */
  158. int cap_ptrace_traceme(struct task_struct *parent)
  159. {
  160. int ret = 0;
  161. const struct cred *cred, *child_cred;
  162. rcu_read_lock();
  163. cred = __task_cred(parent);
  164. child_cred = current_cred();
  165. if (cred->user_ns == child_cred->user_ns &&
  166. cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
  167. goto out;
  168. if (has_ns_capability(parent, child_cred->user_ns, CAP_SYS_PTRACE))
  169. goto out;
  170. ret = -EPERM;
  171. out:
  172. rcu_read_unlock();
  173. return ret;
  174. }
  175. /**
  176. * cap_capget - Retrieve a task's capability sets
  177. * @target: The task from which to retrieve the capability sets
  178. * @effective: The place to record the effective set
  179. * @inheritable: The place to record the inheritable set
  180. * @permitted: The place to record the permitted set
  181. *
  182. * This function retrieves the capabilities of the nominated task and returns
  183. * them to the caller.
  184. */
  185. int cap_capget(struct task_struct *target, kernel_cap_t *effective,
  186. kernel_cap_t *inheritable, kernel_cap_t *permitted)
  187. {
  188. const struct cred *cred;
  189. /* Derived from kernel/capability.c:sys_capget. */
  190. rcu_read_lock();
  191. cred = __task_cred(target);
  192. *effective = cred->cap_effective;
  193. *inheritable = cred->cap_inheritable;
  194. *permitted = cred->cap_permitted;
  195. rcu_read_unlock();
  196. return 0;
  197. }
  198. /*
  199. * Determine whether the inheritable capabilities are limited to the old
  200. * permitted set. Returns 1 if they are limited, 0 if they are not.
  201. */
  202. static inline int cap_inh_is_capped(void)
  203. {
  204. /* they are so limited unless the current task has the CAP_SETPCAP
  205. * capability
  206. */
  207. if (cap_capable(current_cred(), current_cred()->user_ns,
  208. CAP_SETPCAP, CAP_OPT_NONE) == 0)
  209. return 0;
  210. return 1;
  211. }
  212. /**
  213. * cap_capset - Validate and apply proposed changes to current's capabilities
  214. * @new: The proposed new credentials; alterations should be made here
  215. * @old: The current task's current credentials
  216. * @effective: A pointer to the proposed new effective capabilities set
  217. * @inheritable: A pointer to the proposed new inheritable capabilities set
  218. * @permitted: A pointer to the proposed new permitted capabilities set
  219. *
  220. * This function validates and applies a proposed mass change to the current
  221. * process's capability sets. The changes are made to the proposed new
  222. * credentials, and assuming no error, will be committed by the caller of LSM.
  223. */
  224. int cap_capset(struct cred *new,
  225. const struct cred *old,
  226. const kernel_cap_t *effective,
  227. const kernel_cap_t *inheritable,
  228. const kernel_cap_t *permitted)
  229. {
  230. if (cap_inh_is_capped() &&
  231. !cap_issubset(*inheritable,
  232. cap_combine(old->cap_inheritable,
  233. old->cap_permitted)))
  234. /* incapable of using this inheritable set */
  235. return -EPERM;
  236. if (!cap_issubset(*inheritable,
  237. cap_combine(old->cap_inheritable,
  238. old->cap_bset)))
  239. /* no new pI capabilities outside bounding set */
  240. return -EPERM;
  241. /* verify restrictions on target's new Permitted set */
  242. if (!cap_issubset(*permitted, old->cap_permitted))
  243. return -EPERM;
  244. /* verify the _new_Effective_ is a subset of the _new_Permitted_ */
  245. if (!cap_issubset(*effective, *permitted))
  246. return -EPERM;
  247. new->cap_effective = *effective;
  248. new->cap_inheritable = *inheritable;
  249. new->cap_permitted = *permitted;
  250. /*
  251. * Mask off ambient bits that are no longer both permitted and
  252. * inheritable.
  253. */
  254. new->cap_ambient = cap_intersect(new->cap_ambient,
  255. cap_intersect(*permitted,
  256. *inheritable));
  257. if (WARN_ON(!cap_ambient_invariant_ok(new)))
  258. return -EINVAL;
  259. return 0;
  260. }
  261. /**
  262. * cap_inode_need_killpriv - Determine if inode change affects privileges
  263. * @dentry: The inode/dentry in being changed with change marked ATTR_KILL_PRIV
  264. *
  265. * Determine if an inode having a change applied that's marked ATTR_KILL_PRIV
  266. * affects the security markings on that inode, and if it is, should
  267. * inode_killpriv() be invoked or the change rejected.
  268. *
  269. * Returns 1 if security.capability has a value, meaning inode_killpriv()
  270. * is required, 0 otherwise, meaning inode_killpriv() is not required.
  271. */
  272. int cap_inode_need_killpriv(struct dentry *dentry)
  273. {
  274. struct inode *inode = d_backing_inode(dentry);
  275. int error;
  276. error = __vfs_getxattr(dentry, inode, XATTR_NAME_CAPS, NULL, 0,
  277. XATTR_NOSECURITY);
  278. return error > 0;
  279. }
  280. /**
  281. * cap_inode_killpriv - Erase the security markings on an inode
  282. * @dentry: The inode/dentry to alter
  283. *
  284. * Erase the privilege-enhancing security markings on an inode.
  285. *
  286. * Returns 0 if successful, -ve on error.
  287. */
  288. int cap_inode_killpriv(struct dentry *dentry)
  289. {
  290. int error;
  291. error = __vfs_removexattr(dentry, XATTR_NAME_CAPS);
  292. if (error == -EOPNOTSUPP)
  293. error = 0;
  294. return error;
  295. }
  296. static bool rootid_owns_currentns(kuid_t kroot)
  297. {
  298. struct user_namespace *ns;
  299. if (!uid_valid(kroot))
  300. return false;
  301. for (ns = current_user_ns(); ; ns = ns->parent) {
  302. if (from_kuid(ns, kroot) == 0)
  303. return true;
  304. if (ns == &init_user_ns)
  305. break;
  306. }
  307. return false;
  308. }
  309. static __u32 sansflags(__u32 m)
  310. {
  311. return m & ~VFS_CAP_FLAGS_EFFECTIVE;
  312. }
  313. static bool is_v2header(size_t size, const struct vfs_cap_data *cap)
  314. {
  315. if (size != XATTR_CAPS_SZ_2)
  316. return false;
  317. return sansflags(le32_to_cpu(cap->magic_etc)) == VFS_CAP_REVISION_2;
  318. }
  319. static bool is_v3header(size_t size, const struct vfs_cap_data *cap)
  320. {
  321. if (size != XATTR_CAPS_SZ_3)
  322. return false;
  323. return sansflags(le32_to_cpu(cap->magic_etc)) == VFS_CAP_REVISION_3;
  324. }
  325. /*
  326. * getsecurity: We are called for security.* before any attempt to read the
  327. * xattr from the inode itself.
  328. *
  329. * This gives us a chance to read the on-disk value and convert it. If we
  330. * return -EOPNOTSUPP, then vfs_getxattr() will call the i_op handler.
  331. *
  332. * Note we are not called by vfs_getxattr_alloc(), but that is only called
  333. * by the integrity subsystem, which really wants the unconverted values -
  334. * so that's good.
  335. */
  336. int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
  337. bool alloc)
  338. {
  339. int size, ret;
  340. kuid_t kroot;
  341. u32 nsmagic, magic;
  342. uid_t root, mappedroot;
  343. char *tmpbuf = NULL;
  344. struct vfs_cap_data *cap;
  345. struct vfs_ns_cap_data *nscap = NULL;
  346. struct dentry *dentry;
  347. struct user_namespace *fs_ns;
  348. if (strcmp(name, "capability") != 0)
  349. return -EOPNOTSUPP;
  350. dentry = d_find_any_alias(inode);
  351. if (!dentry)
  352. return -EINVAL;
  353. size = sizeof(struct vfs_ns_cap_data);
  354. ret = (int) vfs_getxattr_alloc(dentry, XATTR_NAME_CAPS,
  355. &tmpbuf, size, GFP_NOFS);
  356. dput(dentry);
  357. if (ret < 0 || !tmpbuf)
  358. return ret;
  359. fs_ns = inode->i_sb->s_user_ns;
  360. cap = (struct vfs_cap_data *) tmpbuf;
  361. if (is_v2header((size_t) ret, cap)) {
  362. root = 0;
  363. } else if (is_v3header((size_t) ret, cap)) {
  364. nscap = (struct vfs_ns_cap_data *) tmpbuf;
  365. root = le32_to_cpu(nscap->rootid);
  366. } else {
  367. size = -EINVAL;
  368. goto out_free;
  369. }
  370. kroot = make_kuid(fs_ns, root);
  371. /* If the root kuid maps to a valid uid in current ns, then return
  372. * this as a nscap. */
  373. mappedroot = from_kuid(current_user_ns(), kroot);
  374. if (mappedroot != (uid_t)-1 && mappedroot != (uid_t)0) {
  375. size = sizeof(struct vfs_ns_cap_data);
  376. if (alloc) {
  377. if (!nscap) {
  378. /* v2 -> v3 conversion */
  379. nscap = kzalloc(size, GFP_ATOMIC);
  380. if (!nscap) {
  381. size = -ENOMEM;
  382. goto out_free;
  383. }
  384. nsmagic = VFS_CAP_REVISION_3;
  385. magic = le32_to_cpu(cap->magic_etc);
  386. if (magic & VFS_CAP_FLAGS_EFFECTIVE)
  387. nsmagic |= VFS_CAP_FLAGS_EFFECTIVE;
  388. memcpy(&nscap->data, &cap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
  389. nscap->magic_etc = cpu_to_le32(nsmagic);
  390. } else {
  391. /* use allocated v3 buffer */
  392. tmpbuf = NULL;
  393. }
  394. nscap->rootid = cpu_to_le32(mappedroot);
  395. *buffer = nscap;
  396. }
  397. goto out_free;
  398. }
  399. if (!rootid_owns_currentns(kroot)) {
  400. size = -EOVERFLOW;
  401. goto out_free;
  402. }
  403. /* This comes from a parent namespace. Return as a v2 capability */
  404. size = sizeof(struct vfs_cap_data);
  405. if (alloc) {
  406. if (nscap) {
  407. /* v3 -> v2 conversion */
  408. cap = kzalloc(size, GFP_ATOMIC);
  409. if (!cap) {
  410. size = -ENOMEM;
  411. goto out_free;
  412. }
  413. magic = VFS_CAP_REVISION_2;
  414. nsmagic = le32_to_cpu(nscap->magic_etc);
  415. if (nsmagic & VFS_CAP_FLAGS_EFFECTIVE)
  416. magic |= VFS_CAP_FLAGS_EFFECTIVE;
  417. memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
  418. cap->magic_etc = cpu_to_le32(magic);
  419. } else {
  420. /* use unconverted v2 */
  421. tmpbuf = NULL;
  422. }
  423. *buffer = cap;
  424. }
  425. out_free:
  426. kfree(tmpbuf);
  427. return size;
  428. }
  429. static kuid_t rootid_from_xattr(const void *value, size_t size,
  430. struct user_namespace *task_ns)
  431. {
  432. const struct vfs_ns_cap_data *nscap = value;
  433. uid_t rootid = 0;
  434. if (size == XATTR_CAPS_SZ_3)
  435. rootid = le32_to_cpu(nscap->rootid);
  436. return make_kuid(task_ns, rootid);
  437. }
  438. static bool validheader(size_t size, const struct vfs_cap_data *cap)
  439. {
  440. return is_v2header(size, cap) || is_v3header(size, cap);
  441. }
  442. /*
  443. * User requested a write of security.capability. If needed, update the
  444. * xattr to change from v2 to v3, or to fixup the v3 rootid.
  445. *
  446. * If all is ok, we return the new size, on error return < 0.
  447. */
  448. int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size)
  449. {
  450. struct vfs_ns_cap_data *nscap;
  451. uid_t nsrootid;
  452. const struct vfs_cap_data *cap = *ivalue;
  453. __u32 magic, nsmagic;
  454. struct inode *inode = d_backing_inode(dentry);
  455. struct user_namespace *task_ns = current_user_ns(),
  456. *fs_ns = inode->i_sb->s_user_ns;
  457. kuid_t rootid;
  458. size_t newsize;
  459. if (!*ivalue)
  460. return -EINVAL;
  461. if (!validheader(size, cap))
  462. return -EINVAL;
  463. if (!capable_wrt_inode_uidgid(inode, CAP_SETFCAP))
  464. return -EPERM;
  465. if (size == XATTR_CAPS_SZ_2)
  466. if (ns_capable(inode->i_sb->s_user_ns, CAP_SETFCAP))
  467. /* user is privileged, just write the v2 */
  468. return size;
  469. rootid = rootid_from_xattr(*ivalue, size, task_ns);
  470. if (!uid_valid(rootid))
  471. return -EINVAL;
  472. nsrootid = from_kuid(fs_ns, rootid);
  473. if (nsrootid == -1)
  474. return -EINVAL;
  475. newsize = sizeof(struct vfs_ns_cap_data);
  476. nscap = kmalloc(newsize, GFP_ATOMIC);
  477. if (!nscap)
  478. return -ENOMEM;
  479. nscap->rootid = cpu_to_le32(nsrootid);
  480. nsmagic = VFS_CAP_REVISION_3;
  481. magic = le32_to_cpu(cap->magic_etc);
  482. if (magic & VFS_CAP_FLAGS_EFFECTIVE)
  483. nsmagic |= VFS_CAP_FLAGS_EFFECTIVE;
  484. nscap->magic_etc = cpu_to_le32(nsmagic);
  485. memcpy(&nscap->data, &cap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
  486. kvfree(*ivalue);
  487. *ivalue = nscap;
  488. return newsize;
  489. }
  490. /*
  491. * Calculate the new process capability sets from the capability sets attached
  492. * to a file.
  493. */
  494. static inline int bprm_caps_from_vfs_caps(struct cpu_vfs_cap_data *caps,
  495. struct linux_binprm *bprm,
  496. bool *effective,
  497. bool *has_fcap)
  498. {
  499. struct cred *new = bprm->cred;
  500. unsigned i;
  501. int ret = 0;
  502. if (caps->magic_etc & VFS_CAP_FLAGS_EFFECTIVE)
  503. *effective = true;
  504. if (caps->magic_etc & VFS_CAP_REVISION_MASK)
  505. *has_fcap = true;
  506. CAP_FOR_EACH_U32(i) {
  507. __u32 permitted = caps->permitted.cap[i];
  508. __u32 inheritable = caps->inheritable.cap[i];
  509. /*
  510. * pP' = (X & fP) | (pI & fI)
  511. * The addition of pA' is handled later.
  512. */
  513. new->cap_permitted.cap[i] =
  514. (new->cap_bset.cap[i] & permitted) |
  515. (new->cap_inheritable.cap[i] & inheritable);
  516. if (permitted & ~new->cap_permitted.cap[i])
  517. /* insufficient to execute correctly */
  518. ret = -EPERM;
  519. }
  520. /*
  521. * For legacy apps, with no internal support for recognizing they
  522. * do not have enough capabilities, we return an error if they are
  523. * missing some "forced" (aka file-permitted) capabilities.
  524. */
  525. return *effective ? ret : 0;
  526. }
  527. /*
  528. * Extract the on-exec-apply capability sets for an executable file.
  529. */
  530. int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps)
  531. {
  532. struct inode *inode = d_backing_inode(dentry);
  533. __u32 magic_etc;
  534. unsigned tocopy, i;
  535. int size;
  536. struct vfs_ns_cap_data data, *nscaps = &data;
  537. struct vfs_cap_data *caps = (struct vfs_cap_data *) &data;
  538. kuid_t rootkuid;
  539. struct user_namespace *fs_ns;
  540. memset(cpu_caps, 0, sizeof(struct cpu_vfs_cap_data));
  541. if (!inode)
  542. return -ENODATA;
  543. fs_ns = inode->i_sb->s_user_ns;
  544. size = __vfs_getxattr((struct dentry *)dentry, inode,
  545. XATTR_NAME_CAPS, &data, XATTR_CAPS_SZ,
  546. XATTR_NOSECURITY);
  547. if (size == -ENODATA || size == -EOPNOTSUPP)
  548. /* no data, that's ok */
  549. return -ENODATA;
  550. if (size < 0)
  551. return size;
  552. if (size < sizeof(magic_etc))
  553. return -EINVAL;
  554. cpu_caps->magic_etc = magic_etc = le32_to_cpu(caps->magic_etc);
  555. rootkuid = make_kuid(fs_ns, 0);
  556. switch (magic_etc & VFS_CAP_REVISION_MASK) {
  557. case VFS_CAP_REVISION_1:
  558. if (size != XATTR_CAPS_SZ_1)
  559. return -EINVAL;
  560. tocopy = VFS_CAP_U32_1;
  561. break;
  562. case VFS_CAP_REVISION_2:
  563. if (size != XATTR_CAPS_SZ_2)
  564. return -EINVAL;
  565. tocopy = VFS_CAP_U32_2;
  566. break;
  567. case VFS_CAP_REVISION_3:
  568. if (size != XATTR_CAPS_SZ_3)
  569. return -EINVAL;
  570. tocopy = VFS_CAP_U32_3;
  571. rootkuid = make_kuid(fs_ns, le32_to_cpu(nscaps->rootid));
  572. break;
  573. default:
  574. return -EINVAL;
  575. }
  576. /* Limit the caps to the mounter of the filesystem
  577. * or the more limited uid specified in the xattr.
  578. */
  579. if (!rootid_owns_currentns(rootkuid))
  580. return -ENODATA;
  581. CAP_FOR_EACH_U32(i) {
  582. if (i >= tocopy)
  583. break;
  584. cpu_caps->permitted.cap[i] = le32_to_cpu(caps->data[i].permitted);
  585. cpu_caps->inheritable.cap[i] = le32_to_cpu(caps->data[i].inheritable);
  586. }
  587. cpu_caps->permitted.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
  588. cpu_caps->inheritable.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
  589. cpu_caps->rootid = rootkuid;
  590. return 0;
  591. }
  592. /*
  593. * Attempt to get the on-exec apply capability sets for an executable file from
  594. * its xattrs and, if present, apply them to the proposed credentials being
  595. * constructed by execve().
  596. */
  597. static int get_file_caps(struct linux_binprm *bprm, struct file *file,
  598. bool *effective, bool *has_fcap)
  599. {
  600. int rc = 0;
  601. struct cpu_vfs_cap_data vcaps;
  602. cap_clear(bprm->cred->cap_permitted);
  603. if (!file_caps_enabled)
  604. return 0;
  605. if (!mnt_may_suid(file->f_path.mnt))
  606. return 0;
  607. /*
  608. * This check is redundant with mnt_may_suid() but is kept to make
  609. * explicit that capability bits are limited to s_user_ns and its
  610. * descendants.
  611. */
  612. if (!current_in_userns(file->f_path.mnt->mnt_sb->s_user_ns))
  613. return 0;
  614. rc = get_vfs_caps_from_disk(file->f_path.dentry, &vcaps);
  615. if (rc < 0) {
  616. if (rc == -EINVAL)
  617. printk(KERN_NOTICE "Invalid argument reading file caps for %s\n",
  618. bprm->filename);
  619. else if (rc == -ENODATA)
  620. rc = 0;
  621. goto out;
  622. }
  623. rc = bprm_caps_from_vfs_caps(&vcaps, bprm, effective, has_fcap);
  624. out:
  625. if (rc)
  626. cap_clear(bprm->cred->cap_permitted);
  627. return rc;
  628. }
  629. static inline bool root_privileged(void) { return !issecure(SECURE_NOROOT); }
  630. static inline bool __is_real(kuid_t uid, struct cred *cred)
  631. { return uid_eq(cred->uid, uid); }
  632. static inline bool __is_eff(kuid_t uid, struct cred *cred)
  633. { return uid_eq(cred->euid, uid); }
  634. static inline bool __is_suid(kuid_t uid, struct cred *cred)
  635. { return !__is_real(uid, cred) && __is_eff(uid, cred); }
  636. /*
  637. * handle_privileged_root - Handle case of privileged root
  638. * @bprm: The execution parameters, including the proposed creds
  639. * @has_fcap: Are any file capabilities set?
  640. * @effective: Do we have effective root privilege?
  641. * @root_uid: This namespace' root UID WRT initial USER namespace
  642. *
  643. * Handle the case where root is privileged and hasn't been neutered by
  644. * SECURE_NOROOT. If file capabilities are set, they won't be combined with
  645. * set UID root and nothing is changed. If we are root, cap_permitted is
  646. * updated. If we have become set UID root, the effective bit is set.
  647. */
  648. static void handle_privileged_root(struct linux_binprm *bprm, bool has_fcap,
  649. bool *effective, kuid_t root_uid)
  650. {
  651. const struct cred *old = current_cred();
  652. struct cred *new = bprm->cred;
  653. if (!root_privileged())
  654. return;
  655. /*
  656. * If the legacy file capability is set, then don't set privs
  657. * for a setuid root binary run by a non-root user. Do set it
  658. * for a root user just to cause least surprise to an admin.
  659. */
  660. if (has_fcap && __is_suid(root_uid, new)) {
  661. warn_setuid_and_fcaps_mixed(bprm->filename);
  662. return;
  663. }
  664. /*
  665. * To support inheritance of root-permissions and suid-root
  666. * executables under compatibility mode, we override the
  667. * capability sets for the file.
  668. */
  669. if (__is_eff(root_uid, new) || __is_real(root_uid, new)) {
  670. /* pP' = (cap_bset & ~0) | (pI & ~0) */
  671. new->cap_permitted = cap_combine(old->cap_bset,
  672. old->cap_inheritable);
  673. }
  674. /*
  675. * If only the real uid is 0, we do not set the effective bit.
  676. */
  677. if (__is_eff(root_uid, new))
  678. *effective = true;
  679. }
  680. #define __cap_gained(field, target, source) \
  681. !cap_issubset(target->cap_##field, source->cap_##field)
  682. #define __cap_grew(target, source, cred) \
  683. !cap_issubset(cred->cap_##target, cred->cap_##source)
  684. #define __cap_full(field, cred) \
  685. cap_issubset(CAP_FULL_SET, cred->cap_##field)
  686. static inline bool __is_setuid(struct cred *new, const struct cred *old)
  687. { return !uid_eq(new->euid, old->uid); }
  688. static inline bool __is_setgid(struct cred *new, const struct cred *old)
  689. { return !gid_eq(new->egid, old->gid); }
  690. /*
  691. * 1) Audit candidate if current->cap_effective is set
  692. *
  693. * We do not bother to audit if 3 things are true:
  694. * 1) cap_effective has all caps
  695. * 2) we became root *OR* are were already root
  696. * 3) root is supposed to have all caps (SECURE_NOROOT)
  697. * Since this is just a normal root execing a process.
  698. *
  699. * Number 1 above might fail if you don't have a full bset, but I think
  700. * that is interesting information to audit.
  701. *
  702. * A number of other conditions require logging:
  703. * 2) something prevented setuid root getting all caps
  704. * 3) non-setuid root gets fcaps
  705. * 4) non-setuid root gets ambient
  706. */
  707. static inline bool nonroot_raised_pE(struct cred *new, const struct cred *old,
  708. kuid_t root, bool has_fcap)
  709. {
  710. bool ret = false;
  711. if ((__cap_grew(effective, ambient, new) &&
  712. !(__cap_full(effective, new) &&
  713. (__is_eff(root, new) || __is_real(root, new)) &&
  714. root_privileged())) ||
  715. (root_privileged() &&
  716. __is_suid(root, new) &&
  717. !__cap_full(effective, new)) ||
  718. (!__is_setuid(new, old) &&
  719. ((has_fcap &&
  720. __cap_gained(permitted, new, old)) ||
  721. __cap_gained(ambient, new, old))))
  722. ret = true;
  723. return ret;
  724. }
  725. /**
  726. * cap_bprm_creds_from_file - Set up the proposed credentials for execve().
  727. * @bprm: The execution parameters, including the proposed creds
  728. * @file: The file to pull the credentials from
  729. *
  730. * Set up the proposed credentials for a new execution context being
  731. * constructed by execve(). The proposed creds in @bprm->cred is altered,
  732. * which won't take effect immediately. Returns 0 if successful, -ve on error.
  733. */
  734. int cap_bprm_creds_from_file(struct linux_binprm *bprm, struct file *file)
  735. {
  736. /* Process setpcap binaries and capabilities for uid 0 */
  737. const struct cred *old = current_cred();
  738. struct cred *new = bprm->cred;
  739. bool effective = false, has_fcap = false, is_setid;
  740. int ret;
  741. kuid_t root_uid;
  742. if (WARN_ON(!cap_ambient_invariant_ok(old)))
  743. return -EPERM;
  744. ret = get_file_caps(bprm, file, &effective, &has_fcap);
  745. if (ret < 0)
  746. return ret;
  747. root_uid = make_kuid(new->user_ns, 0);
  748. handle_privileged_root(bprm, has_fcap, &effective, root_uid);
  749. /* if we have fs caps, clear dangerous personality flags */
  750. if (__cap_gained(permitted, new, old))
  751. bprm->per_clear |= PER_CLEAR_ON_SETID;
  752. /* Don't let someone trace a set[ug]id/setpcap binary with the revised
  753. * credentials unless they have the appropriate permit.
  754. *
  755. * In addition, if NO_NEW_PRIVS, then ensure we get no new privs.
  756. */
  757. is_setid = __is_setuid(new, old) || __is_setgid(new, old);
  758. if ((is_setid || __cap_gained(permitted, new, old)) &&
  759. ((bprm->unsafe & ~LSM_UNSAFE_PTRACE) ||
  760. !ptracer_capable(current, new->user_ns))) {
  761. /* downgrade; they get no more than they had, and maybe less */
  762. if (!ns_capable(new->user_ns, CAP_SETUID) ||
  763. (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)) {
  764. new->euid = new->uid;
  765. new->egid = new->gid;
  766. }
  767. new->cap_permitted = cap_intersect(new->cap_permitted,
  768. old->cap_permitted);
  769. }
  770. new->suid = new->fsuid = new->euid;
  771. new->sgid = new->fsgid = new->egid;
  772. /* File caps or setid cancels ambient. */
  773. if (has_fcap || is_setid)
  774. cap_clear(new->cap_ambient);
  775. /*
  776. * Now that we've computed pA', update pP' to give:
  777. * pP' = (X & fP) | (pI & fI) | pA'
  778. */
  779. new->cap_permitted = cap_combine(new->cap_permitted, new->cap_ambient);
  780. /*
  781. * Set pE' = (fE ? pP' : pA'). Because pA' is zero if fE is set,
  782. * this is the same as pE' = (fE ? pP' : 0) | pA'.
  783. */
  784. if (effective)
  785. new->cap_effective = new->cap_permitted;
  786. else
  787. new->cap_effective = new->cap_ambient;
  788. if (WARN_ON(!cap_ambient_invariant_ok(new)))
  789. return -EPERM;
  790. if (nonroot_raised_pE(new, old, root_uid, has_fcap)) {
  791. ret = audit_log_bprm_fcaps(bprm, new, old);
  792. if (ret < 0)
  793. return ret;
  794. }
  795. new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
  796. if (WARN_ON(!cap_ambient_invariant_ok(new)))
  797. return -EPERM;
  798. /* Check for privilege-elevated exec. */
  799. if (is_setid ||
  800. (!__is_real(root_uid, new) &&
  801. (effective ||
  802. __cap_grew(permitted, ambient, new))))
  803. bprm->secureexec = 1;
  804. return 0;
  805. }
  806. /**
  807. * cap_inode_setxattr - Determine whether an xattr may be altered
  808. * @dentry: The inode/dentry being altered
  809. * @name: The name of the xattr to be changed
  810. * @value: The value that the xattr will be changed to
  811. * @size: The size of value
  812. * @flags: The replacement flag
  813. *
  814. * Determine whether an xattr may be altered or set on an inode, returning 0 if
  815. * permission is granted, -ve if denied.
  816. *
  817. * This is used to make sure security xattrs don't get updated or set by those
  818. * who aren't privileged to do so.
  819. */
  820. int cap_inode_setxattr(struct dentry *dentry, const char *name,
  821. const void *value, size_t size, int flags)
  822. {
  823. struct user_namespace *user_ns = dentry->d_sb->s_user_ns;
  824. /* Ignore non-security xattrs */
  825. if (strncmp(name, XATTR_SECURITY_PREFIX,
  826. XATTR_SECURITY_PREFIX_LEN) != 0)
  827. return 0;
  828. /*
  829. * For XATTR_NAME_CAPS the check will be done in
  830. * cap_convert_nscap(), called by setxattr()
  831. */
  832. if (strcmp(name, XATTR_NAME_CAPS) == 0)
  833. return 0;
  834. if (!ns_capable(user_ns, CAP_SYS_ADMIN))
  835. return -EPERM;
  836. return 0;
  837. }
  838. /**
  839. * cap_inode_removexattr - Determine whether an xattr may be removed
  840. * @dentry: The inode/dentry being altered
  841. * @name: The name of the xattr to be changed
  842. *
  843. * Determine whether an xattr may be removed from an inode, returning 0 if
  844. * permission is granted, -ve if denied.
  845. *
  846. * This is used to make sure security xattrs don't get removed by those who
  847. * aren't privileged to remove them.
  848. */
  849. int cap_inode_removexattr(struct dentry *dentry, const char *name)
  850. {
  851. struct user_namespace *user_ns = dentry->d_sb->s_user_ns;
  852. /* Ignore non-security xattrs */
  853. if (strncmp(name, XATTR_SECURITY_PREFIX,
  854. XATTR_SECURITY_PREFIX_LEN) != 0)
  855. return 0;
  856. if (strcmp(name, XATTR_NAME_CAPS) == 0) {
  857. /* security.capability gets namespaced */
  858. struct inode *inode = d_backing_inode(dentry);
  859. if (!inode)
  860. return -EINVAL;
  861. if (!capable_wrt_inode_uidgid(inode, CAP_SETFCAP))
  862. return -EPERM;
  863. return 0;
  864. }
  865. if (!ns_capable(user_ns, CAP_SYS_ADMIN))
  866. return -EPERM;
  867. return 0;
  868. }
  869. /*
  870. * cap_emulate_setxuid() fixes the effective / permitted capabilities of
  871. * a process after a call to setuid, setreuid, or setresuid.
  872. *
  873. * 1) When set*uiding _from_ one of {r,e,s}uid == 0 _to_ all of
  874. * {r,e,s}uid != 0, the permitted and effective capabilities are
  875. * cleared.
  876. *
  877. * 2) When set*uiding _from_ euid == 0 _to_ euid != 0, the effective
  878. * capabilities of the process are cleared.
  879. *
  880. * 3) When set*uiding _from_ euid != 0 _to_ euid == 0, the effective
  881. * capabilities are set to the permitted capabilities.
  882. *
  883. * fsuid is handled elsewhere. fsuid == 0 and {r,e,s}uid!= 0 should
  884. * never happen.
  885. *
  886. * -astor
  887. *
  888. * cevans - New behaviour, Oct '99
  889. * A process may, via prctl(), elect to keep its capabilities when it
  890. * calls setuid() and switches away from uid==0. Both permitted and
  891. * effective sets will be retained.
  892. * Without this change, it was impossible for a daemon to drop only some
  893. * of its privilege. The call to setuid(!=0) would drop all privileges!
  894. * Keeping uid 0 is not an option because uid 0 owns too many vital
  895. * files..
  896. * Thanks to Olaf Kirch and Peter Benie for spotting this.
  897. */
  898. static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)
  899. {
  900. kuid_t root_uid = make_kuid(old->user_ns, 0);
  901. if ((uid_eq(old->uid, root_uid) ||
  902. uid_eq(old->euid, root_uid) ||
  903. uid_eq(old->suid, root_uid)) &&
  904. (!uid_eq(new->uid, root_uid) &&
  905. !uid_eq(new->euid, root_uid) &&
  906. !uid_eq(new->suid, root_uid))) {
  907. if (!issecure(SECURE_KEEP_CAPS)) {
  908. cap_clear(new->cap_permitted);
  909. cap_clear(new->cap_effective);
  910. }
  911. /*
  912. * Pre-ambient programs expect setresuid to nonroot followed
  913. * by exec to drop capabilities. We should make sure that
  914. * this remains the case.
  915. */
  916. cap_clear(new->cap_ambient);
  917. }
  918. if (uid_eq(old->euid, root_uid) && !uid_eq(new->euid, root_uid))
  919. cap_clear(new->cap_effective);
  920. if (!uid_eq(old->euid, root_uid) && uid_eq(new->euid, root_uid))
  921. new->cap_effective = new->cap_permitted;
  922. }
  923. /**
  924. * cap_task_fix_setuid - Fix up the results of setuid() call
  925. * @new: The proposed credentials
  926. * @old: The current task's current credentials
  927. * @flags: Indications of what has changed
  928. *
  929. * Fix up the results of setuid() call before the credential changes are
  930. * actually applied, returning 0 to grant the changes, -ve to deny them.
  931. */
  932. int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
  933. {
  934. switch (flags) {
  935. case LSM_SETID_RE:
  936. case LSM_SETID_ID:
  937. case LSM_SETID_RES:
  938. /* juggle the capabilities to follow [RES]UID changes unless
  939. * otherwise suppressed */
  940. if (!issecure(SECURE_NO_SETUID_FIXUP))
  941. cap_emulate_setxuid(new, old);
  942. break;
  943. case LSM_SETID_FS:
  944. /* juggle the capabilties to follow FSUID changes, unless
  945. * otherwise suppressed
  946. *
  947. * FIXME - is fsuser used for all CAP_FS_MASK capabilities?
  948. * if not, we might be a bit too harsh here.
  949. */
  950. if (!issecure(SECURE_NO_SETUID_FIXUP)) {
  951. kuid_t root_uid = make_kuid(old->user_ns, 0);
  952. if (uid_eq(old->fsuid, root_uid) && !uid_eq(new->fsuid, root_uid))
  953. new->cap_effective =
  954. cap_drop_fs_set(new->cap_effective);
  955. if (!uid_eq(old->fsuid, root_uid) && uid_eq(new->fsuid, root_uid))
  956. new->cap_effective =
  957. cap_raise_fs_set(new->cap_effective,
  958. new->cap_permitted);
  959. }
  960. break;
  961. default:
  962. return -EINVAL;
  963. }
  964. return 0;
  965. }
  966. /*
  967. * Rationale: code calling task_setscheduler, task_setioprio, and
  968. * task_setnice, assumes that
  969. * . if capable(cap_sys_nice), then those actions should be allowed
  970. * . if not capable(cap_sys_nice), but acting on your own processes,
  971. * then those actions should be allowed
  972. * This is insufficient now since you can call code without suid, but
  973. * yet with increased caps.
  974. * So we check for increased caps on the target process.
  975. */
  976. static int cap_safe_nice(struct task_struct *p)
  977. {
  978. int is_subset, ret = 0;
  979. rcu_read_lock();
  980. is_subset = cap_issubset(__task_cred(p)->cap_permitted,
  981. current_cred()->cap_permitted);
  982. if (!is_subset && !ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE))
  983. ret = -EPERM;
  984. rcu_read_unlock();
  985. return ret;
  986. }
  987. /**
  988. * cap_task_setscheduler - Detemine if scheduler policy change is permitted
  989. * @p: The task to affect
  990. *
  991. * Detemine if the requested scheduler policy change is permitted for the
  992. * specified task, returning 0 if permission is granted, -ve if denied.
  993. */
  994. int cap_task_setscheduler(struct task_struct *p)
  995. {
  996. return cap_safe_nice(p);
  997. }
  998. /**
  999. * cap_task_ioprio - Detemine if I/O priority change is permitted
  1000. * @p: The task to affect
  1001. * @ioprio: The I/O priority to set
  1002. *
  1003. * Detemine if the requested I/O priority change is permitted for the specified
  1004. * task, returning 0 if permission is granted, -ve if denied.
  1005. */
  1006. int cap_task_setioprio(struct task_struct *p, int ioprio)
  1007. {
  1008. return cap_safe_nice(p);
  1009. }
  1010. /**
  1011. * cap_task_ioprio - Detemine if task priority change is permitted
  1012. * @p: The task to affect
  1013. * @nice: The nice value to set
  1014. *
  1015. * Detemine if the requested task priority change is permitted for the
  1016. * specified task, returning 0 if permission is granted, -ve if denied.
  1017. */
  1018. int cap_task_setnice(struct task_struct *p, int nice)
  1019. {
  1020. return cap_safe_nice(p);
  1021. }
  1022. /*
  1023. * Implement PR_CAPBSET_DROP. Attempt to remove the specified capability from
  1024. * the current task's bounding set. Returns 0 on success, -ve on error.
  1025. */
  1026. static int cap_prctl_drop(unsigned long cap)
  1027. {
  1028. struct cred *new;
  1029. if (!ns_capable(current_user_ns(), CAP_SETPCAP))
  1030. return -EPERM;
  1031. if (!cap_valid(cap))
  1032. return -EINVAL;
  1033. new = prepare_creds();
  1034. if (!new)
  1035. return -ENOMEM;
  1036. cap_lower(new->cap_bset, cap);
  1037. return commit_creds(new);
  1038. }
  1039. /**
  1040. * cap_task_prctl - Implement process control functions for this security module
  1041. * @option: The process control function requested
  1042. * @arg2, @arg3, @arg4, @arg5: The argument data for this function
  1043. *
  1044. * Allow process control functions (sys_prctl()) to alter capabilities; may
  1045. * also deny access to other functions not otherwise implemented here.
  1046. *
  1047. * Returns 0 or +ve on success, -ENOSYS if this function is not implemented
  1048. * here, other -ve on error. If -ENOSYS is returned, sys_prctl() and other LSM
  1049. * modules will consider performing the function.
  1050. */
  1051. int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
  1052. unsigned long arg4, unsigned long arg5)
  1053. {
  1054. const struct cred *old = current_cred();
  1055. struct cred *new;
  1056. switch (option) {
  1057. case PR_CAPBSET_READ:
  1058. if (!cap_valid(arg2))
  1059. return -EINVAL;
  1060. return !!cap_raised(old->cap_bset, arg2);
  1061. case PR_CAPBSET_DROP:
  1062. return cap_prctl_drop(arg2);
  1063. /*
  1064. * The next four prctl's remain to assist with transitioning a
  1065. * system from legacy UID=0 based privilege (when filesystem
  1066. * capabilities are not in use) to a system using filesystem
  1067. * capabilities only - as the POSIX.1e draft intended.
  1068. *
  1069. * Note:
  1070. *
  1071. * PR_SET_SECUREBITS =
  1072. * issecure_mask(SECURE_KEEP_CAPS_LOCKED)
  1073. * | issecure_mask(SECURE_NOROOT)
  1074. * | issecure_mask(SECURE_NOROOT_LOCKED)
  1075. * | issecure_mask(SECURE_NO_SETUID_FIXUP)
  1076. * | issecure_mask(SECURE_NO_SETUID_FIXUP_LOCKED)
  1077. *
  1078. * will ensure that the current process and all of its
  1079. * children will be locked into a pure
  1080. * capability-based-privilege environment.
  1081. */
  1082. case PR_SET_SECUREBITS:
  1083. if ((((old->securebits & SECURE_ALL_LOCKS) >> 1)
  1084. & (old->securebits ^ arg2)) /*[1]*/
  1085. || ((old->securebits & SECURE_ALL_LOCKS & ~arg2)) /*[2]*/
  1086. || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS)) /*[3]*/
  1087. || (cap_capable(current_cred(),
  1088. current_cred()->user_ns,
  1089. CAP_SETPCAP,
  1090. CAP_OPT_NONE) != 0) /*[4]*/
  1091. /*
  1092. * [1] no changing of bits that are locked
  1093. * [2] no unlocking of locks
  1094. * [3] no setting of unsupported bits
  1095. * [4] doing anything requires privilege (go read about
  1096. * the "sendmail capabilities bug")
  1097. */
  1098. )
  1099. /* cannot change a locked bit */
  1100. return -EPERM;
  1101. new = prepare_creds();
  1102. if (!new)
  1103. return -ENOMEM;
  1104. new->securebits = arg2;
  1105. return commit_creds(new);
  1106. case PR_GET_SECUREBITS:
  1107. return old->securebits;
  1108. case PR_GET_KEEPCAPS:
  1109. return !!issecure(SECURE_KEEP_CAPS);
  1110. case PR_SET_KEEPCAPS:
  1111. if (arg2 > 1) /* Note, we rely on arg2 being unsigned here */
  1112. return -EINVAL;
  1113. if (issecure(SECURE_KEEP_CAPS_LOCKED))
  1114. return -EPERM;
  1115. new = prepare_creds();
  1116. if (!new)
  1117. return -ENOMEM;
  1118. if (arg2)
  1119. new->securebits |= issecure_mask(SECURE_KEEP_CAPS);
  1120. else
  1121. new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
  1122. return commit_creds(new);
  1123. case PR_CAP_AMBIENT:
  1124. if (arg2 == PR_CAP_AMBIENT_CLEAR_ALL) {
  1125. if (arg3 | arg4 | arg5)
  1126. return -EINVAL;
  1127. new = prepare_creds();
  1128. if (!new)
  1129. return -ENOMEM;
  1130. cap_clear(new->cap_ambient);
  1131. return commit_creds(new);
  1132. }
  1133. if (((!cap_valid(arg3)) | arg4 | arg5))
  1134. return -EINVAL;
  1135. if (arg2 == PR_CAP_AMBIENT_IS_SET) {
  1136. return !!cap_raised(current_cred()->cap_ambient, arg3);
  1137. } else if (arg2 != PR_CAP_AMBIENT_RAISE &&
  1138. arg2 != PR_CAP_AMBIENT_LOWER) {
  1139. return -EINVAL;
  1140. } else {
  1141. if (arg2 == PR_CAP_AMBIENT_RAISE &&
  1142. (!cap_raised(current_cred()->cap_permitted, arg3) ||
  1143. !cap_raised(current_cred()->cap_inheritable,
  1144. arg3) ||
  1145. issecure(SECURE_NO_CAP_AMBIENT_RAISE)))
  1146. return -EPERM;
  1147. new = prepare_creds();
  1148. if (!new)
  1149. return -ENOMEM;
  1150. if (arg2 == PR_CAP_AMBIENT_RAISE)
  1151. cap_raise(new->cap_ambient, arg3);
  1152. else
  1153. cap_lower(new->cap_ambient, arg3);
  1154. return commit_creds(new);
  1155. }
  1156. default:
  1157. /* No functionality available - continue with default */
  1158. return -ENOSYS;
  1159. }
  1160. }
  1161. /**
  1162. * cap_vm_enough_memory - Determine whether a new virtual mapping is permitted
  1163. * @mm: The VM space in which the new mapping is to be made
  1164. * @pages: The size of the mapping
  1165. *
  1166. * Determine whether the allocation of a new virtual mapping by the current
  1167. * task is permitted, returning 1 if permission is granted, 0 if not.
  1168. */
  1169. int cap_vm_enough_memory(struct mm_struct *mm, long pages)
  1170. {
  1171. int cap_sys_admin = 0;
  1172. if (cap_capable(current_cred(), &init_user_ns,
  1173. CAP_SYS_ADMIN, CAP_OPT_NOAUDIT) == 0)
  1174. cap_sys_admin = 1;
  1175. return cap_sys_admin;
  1176. }
  1177. /*
  1178. * cap_mmap_addr - check if able to map given addr
  1179. * @addr: address attempting to be mapped
  1180. *
  1181. * If the process is attempting to map memory below dac_mmap_min_addr they need
  1182. * CAP_SYS_RAWIO. The other parameters to this function are unused by the
  1183. * capability security module. Returns 0 if this mapping should be allowed
  1184. * -EPERM if not.
  1185. */
  1186. int cap_mmap_addr(unsigned long addr)
  1187. {
  1188. int ret = 0;
  1189. if (addr < dac_mmap_min_addr) {
  1190. ret = cap_capable(current_cred(), &init_user_ns, CAP_SYS_RAWIO,
  1191. CAP_OPT_NONE);
  1192. /* set PF_SUPERPRIV if it turns out we allow the low mmap */
  1193. if (ret == 0)
  1194. current->flags |= PF_SUPERPRIV;
  1195. }
  1196. return ret;
  1197. }
  1198. int cap_mmap_file(struct file *file, unsigned long reqprot,
  1199. unsigned long prot, unsigned long flags)
  1200. {
  1201. return 0;
  1202. }
  1203. #ifdef CONFIG_SECURITY
  1204. static struct security_hook_list capability_hooks[] __lsm_ro_after_init = {
  1205. LSM_HOOK_INIT(capable, cap_capable),
  1206. LSM_HOOK_INIT(settime, cap_settime),
  1207. LSM_HOOK_INIT(ptrace_access_check, cap_ptrace_access_check),
  1208. LSM_HOOK_INIT(ptrace_traceme, cap_ptrace_traceme),
  1209. LSM_HOOK_INIT(capget, cap_capget),
  1210. LSM_HOOK_INIT(capset, cap_capset),
  1211. LSM_HOOK_INIT(bprm_creds_from_file, cap_bprm_creds_from_file),
  1212. LSM_HOOK_INIT(inode_need_killpriv, cap_inode_need_killpriv),
  1213. LSM_HOOK_INIT(inode_killpriv, cap_inode_killpriv),
  1214. LSM_HOOK_INIT(inode_getsecurity, cap_inode_getsecurity),
  1215. LSM_HOOK_INIT(mmap_addr, cap_mmap_addr),
  1216. LSM_HOOK_INIT(mmap_file, cap_mmap_file),
  1217. LSM_HOOK_INIT(task_fix_setuid, cap_task_fix_setuid),
  1218. LSM_HOOK_INIT(task_prctl, cap_task_prctl),
  1219. LSM_HOOK_INIT(task_setscheduler, cap_task_setscheduler),
  1220. LSM_HOOK_INIT(task_setioprio, cap_task_setioprio),
  1221. LSM_HOOK_INIT(task_setnice, cap_task_setnice),
  1222. LSM_HOOK_INIT(vm_enough_memory, cap_vm_enough_memory),
  1223. };
  1224. static int __init capability_init(void)
  1225. {
  1226. security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks),
  1227. "capability");
  1228. return 0;
  1229. }
  1230. DEFINE_LSM(capability) = {
  1231. .name = "capability",
  1232. .order = LSM_ORDER_FIRST,
  1233. .init = capability_init,
  1234. };
  1235. #endif /* CONFIG_SECURITY */