1 /* Common capabilities, needed by capability.o and root_plug.o
3 * This program is free software; you can redistribute it and/or modify
4 * it under the terms of the GNU General Public License as published by
5 * the Free Software Foundation; either version 2 of the License, or
6 * (at your option) any later version.
10 #include <linux/capability.h>
11 #include <linux/module.h>
12 #include <linux/init.h>
13 #include <linux/kernel.h>
14 #include <linux/security.h>
15 #include <linux/file.h>
17 #include <linux/mman.h>
18 #include <linux/pagemap.h>
19 #include <linux/swap.h>
20 #include <linux/skbuff.h>
21 #include <linux/netlink.h>
22 #include <linux/ptrace.h>
23 #include <linux/xattr.h>
24 #include <linux/hugetlb.h>
25 #include <linux/mount.h>
27 int cap_netlink_send(struct sock
*sk
, struct sk_buff
*skb
)
29 NETLINK_CB(skb
).eff_cap
= current
->cap_effective
;
33 int cap_netlink_recv(struct sk_buff
*skb
, int cap
)
35 if (!cap_raised(NETLINK_CB(skb
).eff_cap
, cap
))
40 EXPORT_SYMBOL(cap_netlink_recv
);
42 int cap_capable (struct task_struct
*tsk
, int cap
)
44 /* Derived from include/linux/sched.h:capable. */
45 if (cap_raised(tsk
->cap_effective
, cap
))
50 int cap_settime(struct timespec
*ts
, struct timezone
*tz
)
52 if (!capable(CAP_SYS_TIME
))
57 int cap_ptrace (struct task_struct
*parent
, struct task_struct
*child
)
59 /* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */
60 if (!cap_issubset(child
->cap_permitted
, parent
->cap_permitted
) &&
61 !__capable(parent
, CAP_SYS_PTRACE
))
66 int cap_capget (struct task_struct
*target
, kernel_cap_t
*effective
,
67 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
69 /* Derived from kernel/capability.c:sys_capget. */
70 *effective
= cap_t (target
->cap_effective
);
71 *inheritable
= cap_t (target
->cap_inheritable
);
72 *permitted
= cap_t (target
->cap_permitted
);
76 int cap_capset_check (struct task_struct
*target
, kernel_cap_t
*effective
,
77 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
79 /* Derived from kernel/capability.c:sys_capset. */
80 /* verify restrictions on target's new Inheritable set */
81 if (!cap_issubset (*inheritable
,
82 cap_combine (target
->cap_inheritable
,
83 current
->cap_permitted
))) {
87 /* verify restrictions on target's new Permitted set */
88 if (!cap_issubset (*permitted
,
89 cap_combine (target
->cap_permitted
,
90 current
->cap_permitted
))) {
94 /* verify the _new_Effective_ is a subset of the _new_Permitted_ */
95 if (!cap_issubset (*effective
, *permitted
)) {
102 void cap_capset_set (struct task_struct
*target
, kernel_cap_t
*effective
,
103 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
105 target
->cap_effective
= *effective
;
106 target
->cap_inheritable
= *inheritable
;
107 target
->cap_permitted
= *permitted
;
110 static inline void bprm_clear_caps(struct linux_binprm
*bprm
)
112 cap_clear(bprm
->cap_inheritable
);
113 cap_clear(bprm
->cap_permitted
);
114 bprm
->cap_effective
= false;
117 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
119 int cap_inode_need_killpriv(struct dentry
*dentry
)
121 struct inode
*inode
= dentry
->d_inode
;
124 if (!inode
->i_op
|| !inode
->i_op
->getxattr
)
127 error
= inode
->i_op
->getxattr(dentry
, XATTR_NAME_CAPS
, NULL
, 0);
133 int cap_inode_killpriv(struct dentry
*dentry
)
135 struct inode
*inode
= dentry
->d_inode
;
137 if (!inode
->i_op
|| !inode
->i_op
->removexattr
)
140 return inode
->i_op
->removexattr(dentry
, XATTR_NAME_CAPS
);
143 static inline int cap_from_disk(__le32
*caps
, struct linux_binprm
*bprm
,
148 if (size
!= XATTR_CAPS_SZ
)
151 magic_etc
= le32_to_cpu(caps
[0]);
153 switch ((magic_etc
& VFS_CAP_REVISION_MASK
)) {
154 case VFS_CAP_REVISION
:
155 if (magic_etc
& VFS_CAP_FLAGS_EFFECTIVE
)
156 bprm
->cap_effective
= true;
158 bprm
->cap_effective
= false;
159 bprm
->cap_permitted
= to_cap_t( le32_to_cpu(caps
[1]) );
160 bprm
->cap_inheritable
= to_cap_t( le32_to_cpu(caps
[2]) );
167 /* Locate any VFS capabilities: */
168 static int get_file_caps(struct linux_binprm
*bprm
)
170 struct dentry
*dentry
;
172 __le32 v1caps
[XATTR_CAPS_SZ
];
175 if (bprm
->file
->f_vfsmnt
->mnt_flags
& MNT_NOSUID
) {
176 bprm_clear_caps(bprm
);
180 dentry
= dget(bprm
->file
->f_dentry
);
181 inode
= dentry
->d_inode
;
182 if (!inode
->i_op
|| !inode
->i_op
->getxattr
)
185 rc
= inode
->i_op
->getxattr(dentry
, XATTR_NAME_CAPS
, &v1caps
,
187 if (rc
== -ENODATA
|| rc
== -EOPNOTSUPP
) {
188 /* no data, that's ok */
195 rc
= cap_from_disk(v1caps
, bprm
, rc
);
197 printk(KERN_NOTICE
"%s: cap_from_disk returned %d for %s\n",
198 __FUNCTION__
, rc
, bprm
->filename
);
203 bprm_clear_caps(bprm
);
209 int cap_inode_need_killpriv(struct dentry
*dentry
)
214 int cap_inode_killpriv(struct dentry
*dentry
)
219 static inline int get_file_caps(struct linux_binprm
*bprm
)
221 bprm_clear_caps(bprm
);
226 int cap_bprm_set_security (struct linux_binprm
*bprm
)
230 ret
= get_file_caps(bprm
);
232 printk(KERN_NOTICE
"%s: get_file_caps returned %d for %s\n",
233 __FUNCTION__
, ret
, bprm
->filename
);
235 /* To support inheritance of root-permissions and suid-root
236 * executables under compatibility mode, we raise all three
237 * capability sets for the file.
239 * If only the real uid is 0, we only raise the inheritable
240 * and permitted sets of the executable file.
243 if (!issecure (SECURE_NOROOT
)) {
244 if (bprm
->e_uid
== 0 || current
->uid
== 0) {
245 cap_set_full (bprm
->cap_inheritable
);
246 cap_set_full (bprm
->cap_permitted
);
248 if (bprm
->e_uid
== 0)
249 bprm
->cap_effective
= true;
255 void cap_bprm_apply_creds (struct linux_binprm
*bprm
, int unsafe
)
257 /* Derived from fs/exec.c:compute_creds. */
258 kernel_cap_t new_permitted
, working
;
260 new_permitted
= cap_intersect (bprm
->cap_permitted
, cap_bset
);
261 working
= cap_intersect (bprm
->cap_inheritable
,
262 current
->cap_inheritable
);
263 new_permitted
= cap_combine (new_permitted
, working
);
265 if (bprm
->e_uid
!= current
->uid
|| bprm
->e_gid
!= current
->gid
||
266 !cap_issubset (new_permitted
, current
->cap_permitted
)) {
267 set_dumpable(current
->mm
, suid_dumpable
);
268 current
->pdeath_signal
= 0;
270 if (unsafe
& ~LSM_UNSAFE_PTRACE_CAP
) {
271 if (!capable(CAP_SETUID
)) {
272 bprm
->e_uid
= current
->uid
;
273 bprm
->e_gid
= current
->gid
;
275 if (!capable (CAP_SETPCAP
)) {
276 new_permitted
= cap_intersect (new_permitted
,
277 current
->cap_permitted
);
282 current
->suid
= current
->euid
= current
->fsuid
= bprm
->e_uid
;
283 current
->sgid
= current
->egid
= current
->fsgid
= bprm
->e_gid
;
285 /* For init, we want to retain the capabilities set
286 * in the init_task struct. Thus we skip the usual
287 * capability rules */
288 if (!is_init(current
)) {
289 current
->cap_permitted
= new_permitted
;
290 current
->cap_effective
= bprm
->cap_effective
?
294 /* AUD: Audit candidate if current->cap_effective is set */
296 current
->keep_capabilities
= 0;
299 int cap_bprm_secureexec (struct linux_binprm
*bprm
)
301 if (current
->uid
!= 0) {
302 if (bprm
->cap_effective
)
304 if (!cap_isclear(bprm
->cap_permitted
))
306 if (!cap_isclear(bprm
->cap_inheritable
))
310 return (current
->euid
!= current
->uid
||
311 current
->egid
!= current
->gid
);
314 int cap_inode_setxattr(struct dentry
*dentry
, char *name
, void *value
,
315 size_t size
, int flags
)
317 if (!strcmp(name
, XATTR_NAME_CAPS
)) {
318 if (!capable(CAP_SETFCAP
))
321 } else if (!strncmp(name
, XATTR_SECURITY_PREFIX
,
322 sizeof(XATTR_SECURITY_PREFIX
) - 1) &&
323 !capable(CAP_SYS_ADMIN
))
328 int cap_inode_removexattr(struct dentry
*dentry
, char *name
)
330 if (!strcmp(name
, XATTR_NAME_CAPS
)) {
331 if (!capable(CAP_SETFCAP
))
334 } else if (!strncmp(name
, XATTR_SECURITY_PREFIX
,
335 sizeof(XATTR_SECURITY_PREFIX
) - 1) &&
336 !capable(CAP_SYS_ADMIN
))
341 /* moved from kernel/sys.c. */
343 * cap_emulate_setxuid() fixes the effective / permitted capabilities of
344 * a process after a call to setuid, setreuid, or setresuid.
346 * 1) When set*uiding _from_ one of {r,e,s}uid == 0 _to_ all of
347 * {r,e,s}uid != 0, the permitted and effective capabilities are
350 * 2) When set*uiding _from_ euid == 0 _to_ euid != 0, the effective
351 * capabilities of the process are cleared.
353 * 3) When set*uiding _from_ euid != 0 _to_ euid == 0, the effective
354 * capabilities are set to the permitted capabilities.
356 * fsuid is handled elsewhere. fsuid == 0 and {r,e,s}uid!= 0 should
361 * cevans - New behaviour, Oct '99
362 * A process may, via prctl(), elect to keep its capabilities when it
363 * calls setuid() and switches away from uid==0. Both permitted and
364 * effective sets will be retained.
365 * Without this change, it was impossible for a daemon to drop only some
366 * of its privilege. The call to setuid(!=0) would drop all privileges!
367 * Keeping uid 0 is not an option because uid 0 owns too many vital
369 * Thanks to Olaf Kirch and Peter Benie for spotting this.
371 static inline void cap_emulate_setxuid (int old_ruid
, int old_euid
,
374 if ((old_ruid
== 0 || old_euid
== 0 || old_suid
== 0) &&
375 (current
->uid
!= 0 && current
->euid
!= 0 && current
->suid
!= 0) &&
376 !current
->keep_capabilities
) {
377 cap_clear (current
->cap_permitted
);
378 cap_clear (current
->cap_effective
);
380 if (old_euid
== 0 && current
->euid
!= 0) {
381 cap_clear (current
->cap_effective
);
383 if (old_euid
!= 0 && current
->euid
== 0) {
384 current
->cap_effective
= current
->cap_permitted
;
388 int cap_task_post_setuid (uid_t old_ruid
, uid_t old_euid
, uid_t old_suid
,
395 /* Copied from kernel/sys.c:setreuid/setuid/setresuid. */
396 if (!issecure (SECURE_NO_SETUID_FIXUP
)) {
397 cap_emulate_setxuid (old_ruid
, old_euid
, old_suid
);
402 uid_t old_fsuid
= old_ruid
;
404 /* Copied from kernel/sys.c:setfsuid. */
407 * FIXME - is fsuser used for all CAP_FS_MASK capabilities?
408 * if not, we might be a bit too harsh here.
411 if (!issecure (SECURE_NO_SETUID_FIXUP
)) {
412 if (old_fsuid
== 0 && current
->fsuid
!= 0) {
413 cap_t (current
->cap_effective
) &=
416 if (old_fsuid
!= 0 && current
->fsuid
== 0) {
417 cap_t (current
->cap_effective
) |=
418 (cap_t (current
->cap_permitted
) &
431 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
433 * Rationale: code calling task_setscheduler, task_setioprio, and
434 * task_setnice, assumes that
435 * . if capable(cap_sys_nice), then those actions should be allowed
436 * . if not capable(cap_sys_nice), but acting on your own processes,
437 * then those actions should be allowed
438 * This is insufficient now since you can call code without suid, but
439 * yet with increased caps.
440 * So we check for increased caps on the target process.
442 static inline int cap_safe_nice(struct task_struct
*p
)
444 if (!cap_issubset(p
->cap_permitted
, current
->cap_permitted
) &&
445 !__capable(current
, CAP_SYS_NICE
))
450 int cap_task_setscheduler (struct task_struct
*p
, int policy
,
451 struct sched_param
*lp
)
453 return cap_safe_nice(p
);
456 int cap_task_setioprio (struct task_struct
*p
, int ioprio
)
458 return cap_safe_nice(p
);
461 int cap_task_setnice (struct task_struct
*p
, int nice
)
463 return cap_safe_nice(p
);
466 int cap_task_kill(struct task_struct
*p
, struct siginfo
*info
,
469 if (info
!= SEND_SIG_NOINFO
&& (is_si_special(info
) || SI_FROMKERNEL(info
)))
474 * Signal sent as a particular user.
475 * Capabilities are ignored. May be wrong, but it's the
476 * only thing we can do at the moment.
477 * Used only by usb drivers?
480 if (cap_issubset(p
->cap_permitted
, current
->cap_permitted
))
482 if (capable(CAP_KILL
))
488 int cap_task_setscheduler (struct task_struct
*p
, int policy
,
489 struct sched_param
*lp
)
493 int cap_task_setioprio (struct task_struct
*p
, int ioprio
)
497 int cap_task_setnice (struct task_struct
*p
, int nice
)
501 int cap_task_kill(struct task_struct
*p
, struct siginfo
*info
,
508 void cap_task_reparent_to_init (struct task_struct
*p
)
510 p
->cap_effective
= CAP_INIT_EFF_SET
;
511 p
->cap_inheritable
= CAP_INIT_INH_SET
;
512 p
->cap_permitted
= CAP_FULL_SET
;
513 p
->keep_capabilities
= 0;
517 int cap_syslog (int type
)
519 if ((type
!= 3 && type
!= 10) && !capable(CAP_SYS_ADMIN
))
524 int cap_vm_enough_memory(struct mm_struct
*mm
, long pages
)
526 int cap_sys_admin
= 0;
528 if (cap_capable(current
, CAP_SYS_ADMIN
) == 0)
530 return __vm_enough_memory(mm
, pages
, cap_sys_admin
);