2005-04-17 02:20:36 +04:00
|
|
|
/*
|
|
|
|
* linux/kernel/capability.c
|
|
|
|
*
|
|
|
|
* Copyright (C) 1997 Andrew Main <zefram@fysh.org>
|
|
|
|
*
|
V3 file capabilities: alter behavior of cap_setpcap
The non-filesystem capability meaning of CAP_SETPCAP is that a process, p1,
can change the capabilities of another process, p2. This is not the
meaning that was intended for this capability at all, and this
implementation came about purely because, without filesystem capabilities,
there was no way to use capabilities without one process bestowing them on
another.
Since we now have a filesystem support for capabilities we can fix the
implementation of CAP_SETPCAP.
The most significant thing about this change is that, with it in effect, no
process can set the capabilities of another process.
The capabilities of a program are set via the capability convolution
rules:
pI(post-exec) = pI(pre-exec)
pP(post-exec) = (X(aka cap_bset) & fP) | (pI(post-exec) & fI)
pE(post-exec) = fE ? pP(post-exec) : 0
at exec() time. As such, the only influence the pre-exec() program can
have on the post-exec() program's capabilities are through the pI
capability set.
The correct implementation for CAP_SETPCAP (and that enabled by this patch)
is that it can be used to add extra pI capabilities to the current process
- to be picked up by subsequent exec()s when the above convolution rules
are applied.
Here is how it works:
Let's say we have a process, p. It has capability sets, pE, pP and pI.
Generally, p, can change the value of its own pI to pI' where
(pI' & ~pI) & ~pP = 0.
That is, the only new things in pI' that were not present in pI need to
be present in pP.
The role of CAP_SETPCAP is basically to permit changes to pI beyond
the above:
if (pE & CAP_SETPCAP) {
pI' = anything; /* ie., even (pI' & ~pI) & ~pP != 0 */
}
This capability is useful for things like login, which (say, via
pam_cap) might want to raise certain inheritable capabilities for use
by the children of the logged-in user's shell, but those capabilities
are not useful to or needed by the login program itself.
One such use might be to limit who can run ping. You set the
capabilities of the 'ping' program to be "= cap_net_raw+i", and then
only shells that have (pI & CAP_NET_RAW) will be able to run
it. Without CAP_SETPCAP implemented as described above, login(pam_cap)
would have to also have (pP & CAP_NET_RAW) in order to raise this
capability and pass it on through the inheritable set.
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-18 14:05:59 +04:00
|
|
|
* Integrated into 2.1.97+, Andrew G. Morgan <morgan@kernel.org>
|
2005-04-17 02:20:36 +04:00
|
|
|
* 30 May 2002: Cleanup, Robert M. Love <rml@tech9.net>
|
2007-10-18 14:06:08 +04:00
|
|
|
*/
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2006-01-11 23:17:46 +03:00
|
|
|
#include <linux/capability.h>
|
2005-04-17 02:20:36 +04:00
|
|
|
#include <linux/mm.h>
|
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/security.h>
|
|
|
|
#include <linux/syscalls.h>
|
2007-10-19 10:39:52 +04:00
|
|
|
#include <linux/pid_namespace.h>
|
2005-04-17 02:20:36 +04:00
|
|
|
#include <asm/uaccess.h>
|
|
|
|
|
|
|
|
/*
|
|
|
|
* This lock protects task->cap_* for all tasks including current.
|
|
|
|
* Locking rule: acquire this prior to tasklist_lock.
|
|
|
|
*/
|
|
|
|
static DEFINE_SPINLOCK(task_capability_lock);
|
|
|
|
|
2008-02-05 09:29:42 +03:00
|
|
|
/*
|
|
|
|
* Leveraged for setting/resetting capabilities
|
|
|
|
*/
|
|
|
|
|
|
|
|
const kernel_cap_t __cap_empty_set = CAP_EMPTY_SET;
|
|
|
|
const kernel_cap_t __cap_full_set = CAP_FULL_SET;
|
|
|
|
const kernel_cap_t __cap_init_eff_set = CAP_INIT_EFF_SET;
|
|
|
|
|
|
|
|
EXPORT_SYMBOL(__cap_empty_set);
|
|
|
|
EXPORT_SYMBOL(__cap_full_set);
|
|
|
|
EXPORT_SYMBOL(__cap_init_eff_set);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* More recent versions of libcap are available from:
|
|
|
|
*
|
|
|
|
* http://www.kernel.org/pub/linux/libs/security/linux-privs/
|
|
|
|
*/
|
|
|
|
|
|
|
|
static void warn_legacy_capability_use(void)
|
|
|
|
{
|
|
|
|
static int warned;
|
|
|
|
if (!warned) {
|
|
|
|
char name[sizeof(current->comm)];
|
|
|
|
|
|
|
|
printk(KERN_INFO "warning: `%s' uses 32-bit capabilities"
|
|
|
|
" (legacy support in use)\n",
|
|
|
|
get_task_comm(name, current));
|
|
|
|
warned = 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2005-04-17 02:20:36 +04:00
|
|
|
/*
|
|
|
|
* For sys_getproccap() and sys_setproccap(), any of the three
|
|
|
|
* capability set pointers may be NULL -- indicating that that set is
|
|
|
|
* uninteresting and/or not to be changed.
|
|
|
|
*/
|
|
|
|
|
2005-07-27 22:45:10 +04:00
|
|
|
/**
|
2005-04-17 02:20:36 +04:00
|
|
|
* sys_capget - get the capabilities of a given process.
|
2005-07-27 22:45:10 +04:00
|
|
|
* @header: pointer to struct that contains capability version and
|
|
|
|
* target pid data
|
|
|
|
* @dataptr: pointer to struct that contains the effective, permitted,
|
|
|
|
* and inheritable capabilities that are returned
|
|
|
|
*
|
|
|
|
* Returns 0 on success and < 0 on error.
|
2005-04-17 02:20:36 +04:00
|
|
|
*/
|
|
|
|
asmlinkage long sys_capget(cap_user_header_t header, cap_user_data_t dataptr)
|
|
|
|
{
|
2007-10-18 14:06:08 +04:00
|
|
|
int ret = 0;
|
|
|
|
pid_t pid;
|
|
|
|
__u32 version;
|
|
|
|
struct task_struct *target;
|
2008-02-05 09:29:42 +03:00
|
|
|
unsigned tocopy;
|
|
|
|
kernel_cap_t pE, pI, pP;
|
2007-10-18 14:06:08 +04:00
|
|
|
|
|
|
|
if (get_user(version, &header->version))
|
|
|
|
return -EFAULT;
|
|
|
|
|
2008-02-05 09:29:42 +03:00
|
|
|
switch (version) {
|
|
|
|
case _LINUX_CAPABILITY_VERSION_1:
|
|
|
|
warn_legacy_capability_use();
|
|
|
|
tocopy = _LINUX_CAPABILITY_U32S_1;
|
|
|
|
break;
|
|
|
|
case _LINUX_CAPABILITY_VERSION_2:
|
|
|
|
tocopy = _LINUX_CAPABILITY_U32S_2;
|
|
|
|
break;
|
|
|
|
default:
|
2007-10-18 14:06:08 +04:00
|
|
|
if (put_user(_LINUX_CAPABILITY_VERSION, &header->version))
|
|
|
|
return -EFAULT;
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2007-10-18 14:06:08 +04:00
|
|
|
if (get_user(pid, &header->pid))
|
|
|
|
return -EFAULT;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2007-10-18 14:06:08 +04:00
|
|
|
if (pid < 0)
|
|
|
|
return -EINVAL;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2007-10-18 14:06:08 +04:00
|
|
|
spin_lock(&task_capability_lock);
|
|
|
|
read_lock(&tasklist_lock);
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2007-10-19 10:40:14 +04:00
|
|
|
if (pid && pid != task_pid_vnr(current)) {
|
2007-10-19 10:40:16 +04:00
|
|
|
target = find_task_by_vpid(pid);
|
2007-10-18 14:06:08 +04:00
|
|
|
if (!target) {
|
|
|
|
ret = -ESRCH;
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
} else
|
|
|
|
target = current;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2008-02-05 09:29:42 +03:00
|
|
|
ret = security_capget(target, &pE, &pI, &pP);
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
out:
|
2007-10-18 14:06:08 +04:00
|
|
|
read_unlock(&tasklist_lock);
|
|
|
|
spin_unlock(&task_capability_lock);
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2008-02-05 09:29:42 +03:00
|
|
|
if (!ret) {
|
|
|
|
struct __user_cap_data_struct kdata[_LINUX_CAPABILITY_U32S];
|
|
|
|
unsigned i;
|
|
|
|
|
|
|
|
for (i = 0; i < tocopy; i++) {
|
|
|
|
kdata[i].effective = pE.cap[i];
|
|
|
|
kdata[i].permitted = pP.cap[i];
|
|
|
|
kdata[i].inheritable = pI.cap[i];
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Note, in the case, tocopy < _LINUX_CAPABILITY_U32S,
|
|
|
|
* we silently drop the upper capabilities here. This
|
|
|
|
* has the effect of making older libcap
|
|
|
|
* implementations implicitly drop upper capability
|
|
|
|
* bits when they perform a: capget/modify/capset
|
|
|
|
* sequence.
|
|
|
|
*
|
|
|
|
* This behavior is considered fail-safe
|
|
|
|
* behavior. Upgrading the application to a newer
|
|
|
|
* version of libcap will enable access to the newer
|
|
|
|
* capabilities.
|
|
|
|
*
|
|
|
|
* An alternative would be to return an error here
|
|
|
|
* (-ERANGE), but that causes legacy applications to
|
|
|
|
* unexpectidly fail; the capget/modify/capset aborts
|
|
|
|
* before modification is attempted and the application
|
|
|
|
* fails.
|
|
|
|
*/
|
|
|
|
|
|
|
|
if (copy_to_user(dataptr, kdata, tocopy
|
|
|
|
* sizeof(struct __user_cap_data_struct))) {
|
|
|
|
return -EFAULT;
|
|
|
|
}
|
|
|
|
}
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2007-10-18 14:06:08 +04:00
|
|
|
return ret;
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* cap_set_pg - set capabilities for all processes in a given process
|
|
|
|
* group. We call this holding task_capability_lock and tasklist_lock.
|
|
|
|
*/
|
2007-02-12 11:53:01 +03:00
|
|
|
static inline int cap_set_pg(int pgrp_nr, kernel_cap_t *effective,
|
2005-04-17 02:20:36 +04:00
|
|
|
kernel_cap_t *inheritable,
|
|
|
|
kernel_cap_t *permitted)
|
|
|
|
{
|
2006-07-03 11:25:41 +04:00
|
|
|
struct task_struct *g, *target;
|
2005-04-17 02:20:36 +04:00
|
|
|
int ret = -EPERM;
|
|
|
|
int found = 0;
|
2007-02-12 11:53:01 +03:00
|
|
|
struct pid *pgrp;
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2007-10-19 10:40:19 +04:00
|
|
|
pgrp = find_vpid(pgrp_nr);
|
2007-02-12 11:53:01 +03:00
|
|
|
do_each_pid_task(pgrp, PIDTYPE_PGID, g) {
|
2005-04-17 02:20:36 +04:00
|
|
|
target = g;
|
|
|
|
while_each_thread(g, target) {
|
|
|
|
if (!security_capset_check(target, effective,
|
|
|
|
inheritable,
|
|
|
|
permitted)) {
|
|
|
|
security_capset_set(target, effective,
|
|
|
|
inheritable,
|
|
|
|
permitted);
|
|
|
|
ret = 0;
|
|
|
|
}
|
|
|
|
found = 1;
|
|
|
|
}
|
2007-02-12 11:53:01 +03:00
|
|
|
} while_each_pid_task(pgrp, PIDTYPE_PGID, g);
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
if (!found)
|
2007-10-18 14:06:08 +04:00
|
|
|
ret = 0;
|
2005-04-17 02:20:36 +04:00
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* cap_set_all - set capabilities for all processes other than init
|
|
|
|
* and self. We call this holding task_capability_lock and tasklist_lock.
|
|
|
|
*/
|
|
|
|
static inline int cap_set_all(kernel_cap_t *effective,
|
|
|
|
kernel_cap_t *inheritable,
|
|
|
|
kernel_cap_t *permitted)
|
|
|
|
{
|
2006-07-03 11:25:41 +04:00
|
|
|
struct task_struct *g, *target;
|
2005-04-17 02:20:36 +04:00
|
|
|
int ret = -EPERM;
|
|
|
|
int found = 0;
|
|
|
|
|
|
|
|
do_each_thread(g, target) {
|
2007-10-19 10:39:52 +04:00
|
|
|
if (target == current || is_container_init(target->group_leader))
|
2005-04-17 02:20:36 +04:00
|
|
|
continue;
|
|
|
|
found = 1;
|
|
|
|
if (security_capset_check(target, effective, inheritable,
|
|
|
|
permitted))
|
|
|
|
continue;
|
|
|
|
ret = 0;
|
|
|
|
security_capset_set(target, effective, inheritable, permitted);
|
|
|
|
} while_each_thread(g, target);
|
|
|
|
|
|
|
|
if (!found)
|
|
|
|
ret = 0;
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2005-07-27 22:45:10 +04:00
|
|
|
/**
|
|
|
|
* sys_capset - set capabilities for a process or a group of processes
|
|
|
|
* @header: pointer to struct that contains capability version and
|
|
|
|
* target pid data
|
|
|
|
* @data: pointer to struct that contains the effective, permitted,
|
|
|
|
* and inheritable capabilities
|
|
|
|
*
|
|
|
|
* Set capabilities for a given process, all processes, or all
|
2005-04-17 02:20:36 +04:00
|
|
|
* processes in a given process group.
|
|
|
|
*
|
|
|
|
* The restrictions on setting capabilities are specified as:
|
|
|
|
*
|
|
|
|
* [pid is for the 'target' task. 'current' is the calling task.]
|
|
|
|
*
|
|
|
|
* I: any raised capabilities must be a subset of the (old current) permitted
|
|
|
|
* P: any raised capabilities must be a subset of the (old current) permitted
|
|
|
|
* E: must be set to a subset of (new target) permitted
|
2005-07-27 22:45:10 +04:00
|
|
|
*
|
|
|
|
* Returns 0 on success and < 0 on error.
|
2005-04-17 02:20:36 +04:00
|
|
|
*/
|
|
|
|
asmlinkage long sys_capset(cap_user_header_t header, const cap_user_data_t data)
|
|
|
|
{
|
2008-02-05 09:29:42 +03:00
|
|
|
struct __user_cap_data_struct kdata[_LINUX_CAPABILITY_U32S];
|
|
|
|
unsigned i, tocopy;
|
2007-10-18 14:06:08 +04:00
|
|
|
kernel_cap_t inheritable, permitted, effective;
|
|
|
|
__u32 version;
|
|
|
|
struct task_struct *target;
|
|
|
|
int ret;
|
|
|
|
pid_t pid;
|
|
|
|
|
|
|
|
if (get_user(version, &header->version))
|
|
|
|
return -EFAULT;
|
|
|
|
|
2008-02-05 09:29:42 +03:00
|
|
|
switch (version) {
|
|
|
|
case _LINUX_CAPABILITY_VERSION_1:
|
|
|
|
warn_legacy_capability_use();
|
|
|
|
tocopy = _LINUX_CAPABILITY_U32S_1;
|
|
|
|
break;
|
|
|
|
case _LINUX_CAPABILITY_VERSION_2:
|
|
|
|
tocopy = _LINUX_CAPABILITY_U32S_2;
|
|
|
|
break;
|
|
|
|
default:
|
2007-10-18 14:06:08 +04:00
|
|
|
if (put_user(_LINUX_CAPABILITY_VERSION, &header->version))
|
|
|
|
return -EFAULT;
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (get_user(pid, &header->pid))
|
|
|
|
return -EFAULT;
|
|
|
|
|
2007-10-19 10:40:14 +04:00
|
|
|
if (pid && pid != task_pid_vnr(current) && !capable(CAP_SETPCAP))
|
2007-10-18 14:06:08 +04:00
|
|
|
return -EPERM;
|
|
|
|
|
2008-02-05 09:29:42 +03:00
|
|
|
if (copy_from_user(&kdata, data, tocopy
|
|
|
|
* sizeof(struct __user_cap_data_struct))) {
|
2007-10-18 14:06:08 +04:00
|
|
|
return -EFAULT;
|
2008-02-05 09:29:42 +03:00
|
|
|
}
|
|
|
|
|
|
|
|
for (i = 0; i < tocopy; i++) {
|
|
|
|
effective.cap[i] = kdata[i].effective;
|
|
|
|
permitted.cap[i] = kdata[i].permitted;
|
|
|
|
inheritable.cap[i] = kdata[i].inheritable;
|
|
|
|
}
|
|
|
|
while (i < _LINUX_CAPABILITY_U32S) {
|
|
|
|
effective.cap[i] = 0;
|
|
|
|
permitted.cap[i] = 0;
|
|
|
|
inheritable.cap[i] = 0;
|
|
|
|
i++;
|
|
|
|
}
|
2007-10-18 14:06:08 +04:00
|
|
|
|
|
|
|
spin_lock(&task_capability_lock);
|
|
|
|
read_lock(&tasklist_lock);
|
|
|
|
|
2007-10-19 10:40:14 +04:00
|
|
|
if (pid > 0 && pid != task_pid_vnr(current)) {
|
2007-10-19 10:40:16 +04:00
|
|
|
target = find_task_by_vpid(pid);
|
2007-10-18 14:06:08 +04:00
|
|
|
if (!target) {
|
|
|
|
ret = -ESRCH;
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
} else
|
|
|
|
target = current;
|
|
|
|
|
|
|
|
ret = 0;
|
|
|
|
|
|
|
|
/* having verified that the proposed changes are legal,
|
|
|
|
we now put them into effect. */
|
|
|
|
if (pid < 0) {
|
|
|
|
if (pid == -1) /* all procs other than current and init */
|
|
|
|
ret = cap_set_all(&effective, &inheritable, &permitted);
|
|
|
|
|
|
|
|
else /* all procs in process group */
|
|
|
|
ret = cap_set_pg(-pid, &effective, &inheritable,
|
|
|
|
&permitted);
|
|
|
|
} else {
|
|
|
|
ret = security_capset_check(target, &effective, &inheritable,
|
|
|
|
&permitted);
|
|
|
|
if (!ret)
|
|
|
|
security_capset_set(target, &effective, &inheritable,
|
|
|
|
&permitted);
|
|
|
|
}
|
2005-04-17 02:20:36 +04:00
|
|
|
|
|
|
|
out:
|
2007-10-18 14:06:08 +04:00
|
|
|
read_unlock(&tasklist_lock);
|
|
|
|
spin_unlock(&task_capability_lock);
|
2005-04-17 02:20:36 +04:00
|
|
|
|
2007-10-18 14:06:08 +04:00
|
|
|
return ret;
|
2005-04-17 02:20:36 +04:00
|
|
|
}
|
2006-03-25 14:07:41 +03:00
|
|
|
|
|
|
|
int __capable(struct task_struct *t, int cap)
|
|
|
|
{
|
|
|
|
if (security_capable(t, cap) == 0) {
|
|
|
|
t->flags |= PF_SUPERPRIV;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
int capable(int cap)
|
|
|
|
{
|
|
|
|
return __capable(current, cap);
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(capable);
|