linux/kernel/capability.c at master · fabgithub/linux · GitHub

Repository navigation

History

466 lines (406 loc) · 12.3 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

382

383

384

385

386

387

388

389

390

391

392

393

394

395

396

397

398

399

400

401

402

403

404

405

406

407

408

409

410

411

412

413

414

415

416

417

418

419

420

421

422

423

424

425

426

427

428

429

430

431

432

433

434

435

436

437

438

439

440

441

442

443

444

445

446

447

448

449

450

451

452

453

454

455

456

457

458

459

460

461

462

463

464

465

466

* linux/kernel/capability.c

* Integrated into 2.1.97+, Andrew G. Morgan <morgan@kernel.org>

* 30 May 2002: Cleanup, Robert M. Love <rml@tech9.net>

#include <linux/audit.h>

#include <linux/capability.h>

#include <linux/mm.h>

#include <linux/export.h>

#include <linux/security.h>

#include <linux/syscalls.h>

#include <linux/pid_namespace.h>

#include <linux/user_namespace.h>

#include <asm/uaccess.h>

* Leveraged for setting/resetting capabilities

const kernel_cap_t __cap_empty_set = CAP_EMPTY_SET;

EXPORT_SYMBOL(__cap_empty_set);

int file_caps_enabled = 1;

static int __init file_caps_disable(char *str)

{

file_caps_enabled = 0;

return 1;

}

__setup("no_file_caps", file_caps_disable);

* More recent versions of libcap are available from:

* http://www.kernel.org/pub/linux/libs/security/linux-privs/

static void warn_legacy_capability_use(void)

{

static int warned;

if (!warned) {

char name[sizeof(current->comm)];

printk(KERN_INFO "warning: `%s' uses 32-bit capabilities"

" (legacy support in use)\n",

get_task_comm(name, current));

warned = 1;

}

* Version 2 capabilities worked fine, but the linux/capability.h file

* that accompanied their introduction encouraged their use without

* the necessary user-space source code changes. As such, we have

* created a version 3 with equivalent functionality to version 2, but

* with a header change to protect legacy source code from using

* version 2 when it wanted to use version 1. If your system has code

* that trips the following warning, it is using version 2 specific

* capabilities and may be doing so insecurely.

* The remedy is to either upgrade your version of libcap (to 2.10+,

* if the application is linked against it), or recompile your

* application with modern kernel headers and this warning will go

* away.

static void warn_deprecated_v2(void)

{

static int warned;

if (!warned) {

char name[sizeof(current->comm)];

printk(KERN_INFO "warning: `%s' uses deprecated v2"

" capabilities in a way that may be insecure.\n",

get_task_comm(name, current));

warned = 1;

}

* Version check. Return the number of u32s in each capability flag

* array, or a negative value on error.

static int cap_validate_magic(cap_user_header_t header, unsigned *tocopy)

{

__u32 version;

if (get_user(version, &header->version))

return -EFAULT;

switch (version) {

case _LINUX_CAPABILITY_VERSION_1:

warn_legacy_capability_use();

*tocopy = _LINUX_CAPABILITY_U32S_1;

break;

case _LINUX_CAPABILITY_VERSION_2:

warn_deprecated_v2();

* fall through - v3 is otherwise equivalent to v2.

case _LINUX_CAPABILITY_VERSION_3:

*tocopy = _LINUX_CAPABILITY_U32S_3;

break;

default:

if (put_user((u32)_KERNEL_CAPABILITY_VERSION, &header->version))

return -EFAULT;

return -EINVAL;

}

return 0;

}

* The only thing that can change the capabilities of the current

* process is the current process. As such, we can't be in this code

* at the same time as we are in the process of setting capabilities

* in this process. The net result is that we can limit our use of

* locks to when we are reading the caps of another process.

static inline int cap_get_target_pid(pid_t pid, kernel_cap_t *pEp,

kernel_cap_t *pIp, kernel_cap_t *pPp)

{

int ret;

if (pid && (pid != task_pid_vnr(current))) {

struct task_struct *target;

rcu_read_lock();

target = find_task_by_vpid(pid);

if (!target)

ret = -ESRCH;

else

ret = security_capget(target, pEp, pIp, pPp);

rcu_read_unlock();

} else

ret = security_capget(current, pEp, pIp, pPp);

return ret;

}

/**

* sys_capget - get the capabilities of a given process.

* @header: pointer to struct that contains capability version and

* target pid data

* @dataptr: pointer to struct that contains the effective, permitted,

* and inheritable capabilities that are returned

* Returns 0 on success and < 0 on error.

SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)

{

int ret = 0;

pid_t pid;

unsigned tocopy;

kernel_cap_t pE, pI, pP;

ret = cap_validate_magic(header, &tocopy);

if ((dataptr == NULL) || (ret != 0))

return ((dataptr == NULL) && (ret == -EINVAL)) ? 0 : ret;

if (get_user(pid, &header->pid))

return -EFAULT;

if (pid < 0)

return -EINVAL;

ret = cap_get_target_pid(pid, &pE, &pI, &pP);

if (!ret) {

struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S];

unsigned i;

for (i = 0; i < tocopy; i++) {

kdata[i].effective = pE.cap[i];

kdata[i].permitted = pP.cap[i];

kdata[i].inheritable = pI.cap[i];

}

* Note, in the case, tocopy < _KERNEL_CAPABILITY_U32S,

* we silently drop the upper capabilities here. This

* has the effect of making older libcap

* implementations implicitly drop upper capability

* bits when they perform a: capget/modify/capset

* sequence.

* This behavior is considered fail-safe

* behavior. Upgrading the application to a newer

* version of libcap will enable access to the newer

* capabilities.

* An alternative would be to return an error here

* (-ERANGE), but that causes legacy applications to

* unexpectidly fail; the capget/modify/capset aborts

* before modification is attempted and the application

* fails.

if (copy_to_user(dataptr, kdata, tocopy

* sizeof(struct __user_cap_data_struct))) {

return -EFAULT;

}

return ret;

}

/**

* sys_capset - set capabilities for a process or (*) a group of processes

* @header: pointer to struct that contains capability version and

* target pid data

* @data: pointer to struct that contains the effective, permitted,

* and inheritable capabilities

* Set capabilities for the current process only. The ability to any other

* process(es) has been deprecated and removed.

* The restrictions on setting capabilities are specified as:

* I: any raised capabilities must be a subset of the old permitted

* P: any raised capabilities must be a subset of the old permitted

* E: must be set to a subset of new permitted

* Returns 0 on success and < 0 on error.

SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data)

{

struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S];

unsigned i, tocopy, copybytes;

kernel_cap_t inheritable, permitted, effective;

struct cred *new;

int ret;

pid_t pid;

ret = cap_validate_magic(header, &tocopy);

if (ret != 0)

return ret;

if (get_user(pid, &header->pid))

return -EFAULT;

/* may only affect current now */

if (pid != 0 && pid != task_pid_vnr(current))

return -EPERM;

copybytes = tocopy * sizeof(struct __user_cap_data_struct);

if (copybytes > sizeof(kdata))

return -EFAULT;

if (copy_from_user(&kdata, data, copybytes))

return -EFAULT;

for (i = 0; i < tocopy; i++) {

effective.cap[i] = kdata[i].effective;

permitted.cap[i] = kdata[i].permitted;

inheritable.cap[i] = kdata[i].inheritable;

}

while (i < _KERNEL_CAPABILITY_U32S) {

effective.cap[i] = 0;

permitted.cap[i] = 0;

inheritable.cap[i] = 0;

i++;

}

new = prepare_creds();

if (!new)

return -ENOMEM;

ret = security_capset(new, current_cred(),

&effective, &inheritable, &permitted);

if (ret < 0)

goto error;

audit_log_capset(pid, new, current_cred());

return commit_creds(new);

error:

abort_creds(new);

return ret;

}

/**

* has_ns_capability - Does a task have a capability in a specific user ns

* @t: The task in question

* @ns: target user namespace

* @cap: The capability to be tested for

* Return true if the specified task has the given superior capability

* currently in effect to the specified user namespace, false if not.

* Note that this does not set PF_SUPERPRIV on the task.

bool has_ns_capability(struct task_struct *t,

struct user_namespace *ns, int cap)

{

int ret;

rcu_read_lock();

ret = security_capable(__task_cred(t), ns, cap);

rcu_read_unlock();

return (ret == 0);

}

/**

* has_capability - Does a task have a capability in init_user_ns

* @t: The task in question

* @cap: The capability to be tested for

* Return true if the specified task has the given superior capability

* currently in effect to the initial user namespace, false if not.

* Note that this does not set PF_SUPERPRIV on the task.

bool has_capability(struct task_struct *t, int cap)

{

return has_ns_capability(t, &init_user_ns, cap);

}

/**

* has_ns_capability_noaudit - Does a task have a capability (unaudited)

* in a specific user ns.

* @t: The task in question

* @ns: target user namespace

* @cap: The capability to be tested for

* Return true if the specified task has the given superior capability

* currently in effect to the specified user namespace, false if not.

* Do not write an audit message for the check.

* Note that this does not set PF_SUPERPRIV on the task.

bool has_ns_capability_noaudit(struct task_struct *t,

struct user_namespace *ns, int cap)

{

int ret;

rcu_read_lock();

ret = security_capable_noaudit(__task_cred(t), ns, cap);

rcu_read_unlock();

return (ret == 0);

}

/**

* has_capability_noaudit - Does a task have a capability (unaudited) in the

* initial user ns

* @t: The task in question

* @cap: The capability to be tested for

* Return true if the specified task has the given superior capability

* currently in effect to init_user_ns, false if not. Don't write an

* audit message for the check.

* Note that this does not set PF_SUPERPRIV on the task.

bool has_capability_noaudit(struct task_struct *t, int cap)

{

return has_ns_capability_noaudit(t, &init_user_ns, cap);

}

/**

* ns_capable - Determine if the current task has a superior capability in effect

* @ns: The usernamespace we want the capability in

* @cap: The capability to be tested for

* Return true if the current task has the given superior capability currently

* available for use, false if not.

* This sets PF_SUPERPRIV on the task if the capability is available on the

* assumption that it's about to be used.

bool ns_capable(struct user_namespace *ns, int cap)

{

if (unlikely(!cap_valid(cap))) {

printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);

BUG();

}

if (security_capable(current_cred(), ns, cap) == 0) {

current->flags |= PF_SUPERPRIV;

return true;

}

return false;

}

EXPORT_SYMBOL(ns_capable);

/**

* file_ns_capable - Determine if the file's opener had a capability in effect

* @file: The file we want to check

* @ns: The usernamespace we want the capability in

* @cap: The capability to be tested for

* Return true if task that opened the file had a capability in effect

* when the file was opened.

* This does not set PF_SUPERPRIV because the caller may not

* actually be privileged.

bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap)

{

if (WARN_ON_ONCE(!cap_valid(cap)))

return false;

if (security_capable(file->f_cred, ns, cap) == 0)

return true;

return false;

}

EXPORT_SYMBOL(file_ns_capable);

/**

* capable - Determine if the current task has a superior capability in effect

* @cap: The capability to be tested for

* Return true if the current task has the given superior capability currently

* available for use, false if not.

* This sets PF_SUPERPRIV on the task if the capability is available on the

* assumption that it's about to be used.

bool capable(int cap)

{

return ns_capable(&init_user_ns, cap);

}

EXPORT_SYMBOL(capable);

/**

* nsown_capable - Check superior capability to one's own user_ns

* @cap: The capability in question

* Return true if the current task has the given superior capability

* targeted at its own user namespace.

bool nsown_capable(int cap)

{

return ns_capable(current_user_ns(), cap);

}

/**

* inode_capable - Check superior capability over inode

* @inode: The inode in question

* @cap: The capability in question

* Return true if the current task has the given superior capability

* targeted at it's own user namespace and that the given inode is owned

* by the current user namespace or a child namespace.

* Currently we check to see if an inode is owned by the current

* user namespace by seeing if the inode's owner maps into the

* current user namespace.

bool inode_capable(const struct inode *inode, int cap)

{

struct user_namespace *ns = current_user_ns();

return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid);

}

linux/kernel/capability.c at master · fabgithub/linux · GitHub

Repository navigation

Expand file tree

Breadcrumbs

capability.c

Latest commit

History

Breadcrumbs

capability.c

File metadata and controls