1 /* SPDX-License-Identifier: GPL-2.0 */
3 * This is <linux/capability.h>
5 * Andrew G. Morgan <morgan@kernel.org>
6 * Alexander Kjeldaas <astor@guardian.no>
7 * with help from Aleph1, Roland Buresund and Andrew Main.
9 * See here for the libcap library ("POSIX draft" compliance):
11 * ftp://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.6/
13 #ifndef _LINUX_CAPABILITY_H
14 #define _LINUX_CAPABILITY_H
16 #include <uapi/linux/capability.h>
17 #include <linux/uidgid.h>
19 #define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3
20 #define _KERNEL_CAPABILITY_U32S _LINUX_CAPABILITY_U32S_3
22 extern int file_caps_enabled
;
24 typedef struct kernel_cap_struct
{
25 __u32 cap
[_KERNEL_CAPABILITY_U32S
];
28 /* same as vfs_ns_cap_data but in cpu endian and always filled completely */
29 struct cpu_vfs_cap_data
{
31 kernel_cap_t permitted
;
32 kernel_cap_t inheritable
;
36 #define _USER_CAP_HEADER_SIZE (sizeof(struct __user_cap_header_struct))
37 #define _KERNEL_CAP_T_SIZE (sizeof(kernel_cap_t))
44 struct user_namespace
;
46 extern const kernel_cap_t __cap_empty_set
;
47 extern const kernel_cap_t __cap_init_eff_set
;
50 * Internal kernel functions only
53 #define CAP_FOR_EACH_U32(__capi) \
54 for (__capi = 0; __capi < _KERNEL_CAPABILITY_U32S; ++__capi)
57 * CAP_FS_MASK and CAP_NFSD_MASKS:
59 * The fs mask is all the privileges that fsuid==0 historically meant.
60 * At one time in the past, that included CAP_MKNOD and CAP_LINUX_IMMUTABLE.
62 * It has never meant setting security.* and trusted.* xattrs.
64 * We could also define fsmask as follows:
65 * 1. CAP_FS_MASK is the privilege to bypass all fs-related DAC permissions
66 * 2. The security.* and trusted.* xattrs are fs-related MAC permissions
69 # define CAP_FS_MASK_B0 (CAP_TO_MASK(CAP_CHOWN) \
70 | CAP_TO_MASK(CAP_MKNOD) \
71 | CAP_TO_MASK(CAP_DAC_OVERRIDE) \
72 | CAP_TO_MASK(CAP_DAC_READ_SEARCH) \
73 | CAP_TO_MASK(CAP_FOWNER) \
74 | CAP_TO_MASK(CAP_FSETID))
76 # define CAP_FS_MASK_B1 (CAP_TO_MASK(CAP_MAC_OVERRIDE))
78 #if _KERNEL_CAPABILITY_U32S != 2
79 # error Fix up hand-coded capability macro initializers
80 #else /* HAND-CODED capability initializers */
82 #define CAP_LAST_U32 ((_KERNEL_CAPABILITY_U32S) - 1)
83 #define CAP_LAST_U32_VALID_MASK (CAP_TO_MASK(CAP_LAST_CAP + 1) -1)
85 # define CAP_EMPTY_SET ((kernel_cap_t){{ 0, 0 }})
86 # define CAP_FULL_SET ((kernel_cap_t){{ ~0, CAP_LAST_U32_VALID_MASK }})
87 # define CAP_FS_SET ((kernel_cap_t){{ CAP_FS_MASK_B0 \
88 | CAP_TO_MASK(CAP_LINUX_IMMUTABLE), \
90 # define CAP_NFSD_SET ((kernel_cap_t){{ CAP_FS_MASK_B0 \
91 | CAP_TO_MASK(CAP_SYS_RESOURCE), \
94 #endif /* _KERNEL_CAPABILITY_U32S != 2 */
96 # define cap_clear(c) do { (c) = __cap_empty_set; } while (0)
98 #define cap_raise(c, flag) ((c).cap[CAP_TO_INDEX(flag)] |= CAP_TO_MASK(flag))
99 #define cap_lower(c, flag) ((c).cap[CAP_TO_INDEX(flag)] &= ~CAP_TO_MASK(flag))
100 #define cap_raised(c, flag) ((c).cap[CAP_TO_INDEX(flag)] & CAP_TO_MASK(flag))
102 #define CAP_BOP_ALL(c, a, b, OP) \
105 CAP_FOR_EACH_U32(__capi) { \
106 c.cap[__capi] = a.cap[__capi] OP b.cap[__capi]; \
110 #define CAP_UOP_ALL(c, a, OP) \
113 CAP_FOR_EACH_U32(__capi) { \
114 c.cap[__capi] = OP a.cap[__capi]; \
118 static inline kernel_cap_t
cap_combine(const kernel_cap_t a
,
119 const kernel_cap_t b
)
122 CAP_BOP_ALL(dest
, a
, b
, |);
126 static inline kernel_cap_t
cap_intersect(const kernel_cap_t a
,
127 const kernel_cap_t b
)
130 CAP_BOP_ALL(dest
, a
, b
, &);
134 static inline kernel_cap_t
cap_drop(const kernel_cap_t a
,
135 const kernel_cap_t drop
)
138 CAP_BOP_ALL(dest
, a
, drop
, &~);
142 static inline kernel_cap_t
cap_invert(const kernel_cap_t c
)
145 CAP_UOP_ALL(dest
, c
, ~);
149 static inline bool cap_isclear(const kernel_cap_t a
)
152 CAP_FOR_EACH_U32(__capi
) {
153 if (a
.cap
[__capi
] != 0)
160 * Check if "a" is a subset of "set".
161 * return true if ALL of the capabilities in "a" are also in "set"
162 * cap_issubset(0101, 1111) will return true
163 * return false if ANY of the capabilities in "a" are not in "set"
164 * cap_issubset(1111, 0101) will return false
166 static inline bool cap_issubset(const kernel_cap_t a
, const kernel_cap_t set
)
169 dest
= cap_drop(a
, set
);
170 return cap_isclear(dest
);
173 /* Used to decide between falling back on the old suser() or fsuser(). */
175 static inline kernel_cap_t
cap_drop_fs_set(const kernel_cap_t a
)
177 const kernel_cap_t __cap_fs_set
= CAP_FS_SET
;
178 return cap_drop(a
, __cap_fs_set
);
181 static inline kernel_cap_t
cap_raise_fs_set(const kernel_cap_t a
,
182 const kernel_cap_t permitted
)
184 const kernel_cap_t __cap_fs_set
= CAP_FS_SET
;
185 return cap_combine(a
,
186 cap_intersect(permitted
, __cap_fs_set
));
189 static inline kernel_cap_t
cap_drop_nfsd_set(const kernel_cap_t a
)
191 const kernel_cap_t __cap_fs_set
= CAP_NFSD_SET
;
192 return cap_drop(a
, __cap_fs_set
);
195 static inline kernel_cap_t
cap_raise_nfsd_set(const kernel_cap_t a
,
196 const kernel_cap_t permitted
)
198 const kernel_cap_t __cap_nfsd_set
= CAP_NFSD_SET
;
199 return cap_combine(a
,
200 cap_intersect(permitted
, __cap_nfsd_set
));
203 #ifdef CONFIG_MULTIUSER
204 extern bool has_capability(struct task_struct
*t
, int cap
);
205 extern bool has_ns_capability(struct task_struct
*t
,
206 struct user_namespace
*ns
, int cap
);
207 extern bool has_capability_noaudit(struct task_struct
*t
, int cap
);
208 extern bool has_ns_capability_noaudit(struct task_struct
*t
,
209 struct user_namespace
*ns
, int cap
);
210 extern bool capable(int cap
);
211 extern bool ns_capable(struct user_namespace
*ns
, int cap
);
212 extern bool ns_capable_noaudit(struct user_namespace
*ns
, int cap
);
213 extern bool ns_capable_setid(struct user_namespace
*ns
, int cap
);
215 static inline bool has_capability(struct task_struct
*t
, int cap
)
219 static inline bool has_ns_capability(struct task_struct
*t
,
220 struct user_namespace
*ns
, int cap
)
224 static inline bool has_capability_noaudit(struct task_struct
*t
, int cap
)
228 static inline bool has_ns_capability_noaudit(struct task_struct
*t
,
229 struct user_namespace
*ns
, int cap
)
233 static inline bool capable(int cap
)
237 static inline bool ns_capable(struct user_namespace
*ns
, int cap
)
241 static inline bool ns_capable_noaudit(struct user_namespace
*ns
, int cap
)
245 static inline bool ns_capable_setid(struct user_namespace
*ns
, int cap
)
249 #endif /* CONFIG_MULTIUSER */
250 bool privileged_wrt_inode_uidgid(struct user_namespace
*ns
,
251 struct user_namespace
*mnt_userns
,
252 const struct inode
*inode
);
253 bool capable_wrt_inode_uidgid(struct user_namespace
*mnt_userns
,
254 const struct inode
*inode
, int cap
);
255 extern bool file_ns_capable(const struct file
*file
, struct user_namespace
*ns
, int cap
);
256 extern bool ptracer_capable(struct task_struct
*tsk
, struct user_namespace
*ns
);
257 static inline bool perfmon_capable(void)
259 return capable(CAP_PERFMON
) || capable(CAP_SYS_ADMIN
);
262 static inline bool bpf_capable(void)
264 return capable(CAP_BPF
) || capable(CAP_SYS_ADMIN
);
267 static inline bool checkpoint_restore_ns_capable(struct user_namespace
*ns
)
269 return ns_capable(ns
, CAP_CHECKPOINT_RESTORE
) ||
270 ns_capable(ns
, CAP_SYS_ADMIN
);
273 /* audit system wants to get cap info from files as well */
274 int get_vfs_caps_from_disk(struct user_namespace
*mnt_userns
,
275 const struct dentry
*dentry
,
276 struct cpu_vfs_cap_data
*cpu_caps
);
278 int cap_convert_nscap(struct user_namespace
*mnt_userns
, struct dentry
*dentry
,
279 const void **ivalue
, size_t size
);
281 #endif /* !_LINUX_CAPABILITY_H */