1 /* Common capabilities, needed by capability.o and root_plug.o
3 * This program is free software; you can redistribute it and/or modify
4 * it under the terms of the GNU General Public License as published by
5 * the Free Software Foundation; either version 2 of the License, or
6 * (at your option) any later version.
10 #include <linux/capability.h>
11 #include <linux/module.h>
12 #include <linux/init.h>
13 #include <linux/kernel.h>
14 #include <linux/security.h>
15 #include <linux/file.h>
17 #include <linux/mman.h>
18 #include <linux/pagemap.h>
19 #include <linux/swap.h>
20 #include <linux/skbuff.h>
21 #include <linux/netlink.h>
22 #include <linux/ptrace.h>
23 #include <linux/xattr.h>
24 #include <linux/hugetlb.h>
25 #include <linux/mount.h>
27 int cap_netlink_send(struct sock
*sk
, struct sk_buff
*skb
)
29 NETLINK_CB(skb
).eff_cap
= current
->cap_effective
;
33 EXPORT_SYMBOL(cap_netlink_send
);
35 int cap_netlink_recv(struct sk_buff
*skb
, int cap
)
37 if (!cap_raised(NETLINK_CB(skb
).eff_cap
, cap
))
42 EXPORT_SYMBOL(cap_netlink_recv
);
44 int cap_capable (struct task_struct
*tsk
, int cap
)
46 /* Derived from include/linux/sched.h:capable. */
47 if (cap_raised(tsk
->cap_effective
, cap
))
52 int cap_settime(struct timespec
*ts
, struct timezone
*tz
)
54 if (!capable(CAP_SYS_TIME
))
59 int cap_ptrace (struct task_struct
*parent
, struct task_struct
*child
)
61 /* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */
62 if (!cap_issubset(child
->cap_permitted
, parent
->cap_permitted
) &&
63 !__capable(parent
, CAP_SYS_PTRACE
))
68 int cap_capget (struct task_struct
*target
, kernel_cap_t
*effective
,
69 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
71 /* Derived from kernel/capability.c:sys_capget. */
72 *effective
= cap_t (target
->cap_effective
);
73 *inheritable
= cap_t (target
->cap_inheritable
);
74 *permitted
= cap_t (target
->cap_permitted
);
78 int cap_capset_check (struct task_struct
*target
, kernel_cap_t
*effective
,
79 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
81 /* Derived from kernel/capability.c:sys_capset. */
82 /* verify restrictions on target's new Inheritable set */
83 if (!cap_issubset (*inheritable
,
84 cap_combine (target
->cap_inheritable
,
85 current
->cap_permitted
))) {
89 /* verify restrictions on target's new Permitted set */
90 if (!cap_issubset (*permitted
,
91 cap_combine (target
->cap_permitted
,
92 current
->cap_permitted
))) {
96 /* verify the _new_Effective_ is a subset of the _new_Permitted_ */
97 if (!cap_issubset (*effective
, *permitted
)) {
104 void cap_capset_set (struct task_struct
*target
, kernel_cap_t
*effective
,
105 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
107 target
->cap_effective
= *effective
;
108 target
->cap_inheritable
= *inheritable
;
109 target
->cap_permitted
= *permitted
;
112 static inline void bprm_clear_caps(struct linux_binprm
*bprm
)
114 cap_clear(bprm
->cap_inheritable
);
115 cap_clear(bprm
->cap_permitted
);
116 bprm
->cap_effective
= false;
119 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
121 int cap_inode_need_killpriv(struct dentry
*dentry
)
123 struct inode
*inode
= dentry
->d_inode
;
126 if (!inode
->i_op
|| !inode
->i_op
->getxattr
)
129 error
= inode
->i_op
->getxattr(dentry
, XATTR_NAME_CAPS
, NULL
, 0);
135 int cap_inode_killpriv(struct dentry
*dentry
)
137 struct inode
*inode
= dentry
->d_inode
;
139 if (!inode
->i_op
|| !inode
->i_op
->removexattr
)
142 return inode
->i_op
->removexattr(dentry
, XATTR_NAME_CAPS
);
145 static inline int cap_from_disk(__le32
*caps
, struct linux_binprm
*bprm
,
150 if (size
!= XATTR_CAPS_SZ
)
153 magic_etc
= le32_to_cpu(caps
[0]);
155 switch ((magic_etc
& VFS_CAP_REVISION_MASK
)) {
156 case VFS_CAP_REVISION
:
157 if (magic_etc
& VFS_CAP_FLAGS_EFFECTIVE
)
158 bprm
->cap_effective
= true;
160 bprm
->cap_effective
= false;
161 bprm
->cap_permitted
= to_cap_t( le32_to_cpu(caps
[1]) );
162 bprm
->cap_inheritable
= to_cap_t( le32_to_cpu(caps
[2]) );
169 /* Locate any VFS capabilities: */
170 static int get_file_caps(struct linux_binprm
*bprm
)
172 struct dentry
*dentry
;
174 __le32 v1caps
[XATTR_CAPS_SZ
];
177 if (bprm
->file
->f_vfsmnt
->mnt_flags
& MNT_NOSUID
) {
178 bprm_clear_caps(bprm
);
182 dentry
= dget(bprm
->file
->f_dentry
);
183 inode
= dentry
->d_inode
;
184 if (!inode
->i_op
|| !inode
->i_op
->getxattr
)
187 rc
= inode
->i_op
->getxattr(dentry
, XATTR_NAME_CAPS
, &v1caps
,
189 if (rc
== -ENODATA
|| rc
== -EOPNOTSUPP
) {
190 /* no data, that's ok */
197 rc
= cap_from_disk(v1caps
, bprm
, rc
);
199 printk(KERN_NOTICE
"%s: cap_from_disk returned %d for %s\n",
200 __FUNCTION__
, rc
, bprm
->filename
);
205 bprm_clear_caps(bprm
);
211 int cap_inode_need_killpriv(struct dentry
*dentry
)
216 int cap_inode_killpriv(struct dentry
*dentry
)
221 static inline int get_file_caps(struct linux_binprm
*bprm
)
223 bprm_clear_caps(bprm
);
228 int cap_bprm_set_security (struct linux_binprm
*bprm
)
232 ret
= get_file_caps(bprm
);
234 printk(KERN_NOTICE
"%s: get_file_caps returned %d for %s\n",
235 __FUNCTION__
, ret
, bprm
->filename
);
237 /* To support inheritance of root-permissions and suid-root
238 * executables under compatibility mode, we raise all three
239 * capability sets for the file.
241 * If only the real uid is 0, we only raise the inheritable
242 * and permitted sets of the executable file.
245 if (!issecure (SECURE_NOROOT
)) {
246 if (bprm
->e_uid
== 0 || current
->uid
== 0) {
247 cap_set_full (bprm
->cap_inheritable
);
248 cap_set_full (bprm
->cap_permitted
);
250 if (bprm
->e_uid
== 0)
251 bprm
->cap_effective
= true;
257 void cap_bprm_apply_creds (struct linux_binprm
*bprm
, int unsafe
)
259 /* Derived from fs/exec.c:compute_creds. */
260 kernel_cap_t new_permitted
, working
;
262 new_permitted
= cap_intersect (bprm
->cap_permitted
, cap_bset
);
263 working
= cap_intersect (bprm
->cap_inheritable
,
264 current
->cap_inheritable
);
265 new_permitted
= cap_combine (new_permitted
, working
);
267 if (bprm
->e_uid
!= current
->uid
|| bprm
->e_gid
!= current
->gid
||
268 !cap_issubset (new_permitted
, current
->cap_permitted
)) {
269 set_dumpable(current
->mm
, suid_dumpable
);
270 current
->pdeath_signal
= 0;
272 if (unsafe
& ~LSM_UNSAFE_PTRACE_CAP
) {
273 if (!capable(CAP_SETUID
)) {
274 bprm
->e_uid
= current
->uid
;
275 bprm
->e_gid
= current
->gid
;
277 if (!capable (CAP_SETPCAP
)) {
278 new_permitted
= cap_intersect (new_permitted
,
279 current
->cap_permitted
);
284 current
->suid
= current
->euid
= current
->fsuid
= bprm
->e_uid
;
285 current
->sgid
= current
->egid
= current
->fsgid
= bprm
->e_gid
;
287 /* For init, we want to retain the capabilities set
288 * in the init_task struct. Thus we skip the usual
289 * capability rules */
290 if (!is_init(current
)) {
291 current
->cap_permitted
= new_permitted
;
292 current
->cap_effective
= bprm
->cap_effective
?
296 /* AUD: Audit candidate if current->cap_effective is set */
298 current
->keep_capabilities
= 0;
301 int cap_bprm_secureexec (struct linux_binprm
*bprm
)
303 if (current
->uid
!= 0) {
304 if (bprm
->cap_effective
)
306 if (!cap_isclear(bprm
->cap_permitted
))
308 if (!cap_isclear(bprm
->cap_inheritable
))
312 return (current
->euid
!= current
->uid
||
313 current
->egid
!= current
->gid
);
316 int cap_inode_setxattr(struct dentry
*dentry
, char *name
, void *value
,
317 size_t size
, int flags
)
319 if (!strcmp(name
, XATTR_NAME_CAPS
)) {
320 if (!capable(CAP_SETFCAP
))
323 } else if (!strncmp(name
, XATTR_SECURITY_PREFIX
,
324 sizeof(XATTR_SECURITY_PREFIX
) - 1) &&
325 !capable(CAP_SYS_ADMIN
))
330 int cap_inode_removexattr(struct dentry
*dentry
, char *name
)
332 if (!strcmp(name
, XATTR_NAME_CAPS
)) {
333 if (!capable(CAP_SETFCAP
))
336 } else if (!strncmp(name
, XATTR_SECURITY_PREFIX
,
337 sizeof(XATTR_SECURITY_PREFIX
) - 1) &&
338 !capable(CAP_SYS_ADMIN
))
343 /* moved from kernel/sys.c. */
345 * cap_emulate_setxuid() fixes the effective / permitted capabilities of
346 * a process after a call to setuid, setreuid, or setresuid.
348 * 1) When set*uiding _from_ one of {r,e,s}uid == 0 _to_ all of
349 * {r,e,s}uid != 0, the permitted and effective capabilities are
352 * 2) When set*uiding _from_ euid == 0 _to_ euid != 0, the effective
353 * capabilities of the process are cleared.
355 * 3) When set*uiding _from_ euid != 0 _to_ euid == 0, the effective
356 * capabilities are set to the permitted capabilities.
358 * fsuid is handled elsewhere. fsuid == 0 and {r,e,s}uid!= 0 should
363 * cevans - New behaviour, Oct '99
364 * A process may, via prctl(), elect to keep its capabilities when it
365 * calls setuid() and switches away from uid==0. Both permitted and
366 * effective sets will be retained.
367 * Without this change, it was impossible for a daemon to drop only some
368 * of its privilege. The call to setuid(!=0) would drop all privileges!
369 * Keeping uid 0 is not an option because uid 0 owns too many vital
371 * Thanks to Olaf Kirch and Peter Benie for spotting this.
373 static inline void cap_emulate_setxuid (int old_ruid
, int old_euid
,
376 if ((old_ruid
== 0 || old_euid
== 0 || old_suid
== 0) &&
377 (current
->uid
!= 0 && current
->euid
!= 0 && current
->suid
!= 0) &&
378 !current
->keep_capabilities
) {
379 cap_clear (current
->cap_permitted
);
380 cap_clear (current
->cap_effective
);
382 if (old_euid
== 0 && current
->euid
!= 0) {
383 cap_clear (current
->cap_effective
);
385 if (old_euid
!= 0 && current
->euid
== 0) {
386 current
->cap_effective
= current
->cap_permitted
;
390 int cap_task_post_setuid (uid_t old_ruid
, uid_t old_euid
, uid_t old_suid
,
397 /* Copied from kernel/sys.c:setreuid/setuid/setresuid. */
398 if (!issecure (SECURE_NO_SETUID_FIXUP
)) {
399 cap_emulate_setxuid (old_ruid
, old_euid
, old_suid
);
404 uid_t old_fsuid
= old_ruid
;
406 /* Copied from kernel/sys.c:setfsuid. */
409 * FIXME - is fsuser used for all CAP_FS_MASK capabilities?
410 * if not, we might be a bit too harsh here.
413 if (!issecure (SECURE_NO_SETUID_FIXUP
)) {
414 if (old_fsuid
== 0 && current
->fsuid
!= 0) {
415 cap_t (current
->cap_effective
) &=
418 if (old_fsuid
!= 0 && current
->fsuid
== 0) {
419 cap_t (current
->cap_effective
) |=
420 (cap_t (current
->cap_permitted
) &
433 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
435 * Rationale: code calling task_setscheduler, task_setioprio, and
436 * task_setnice, assumes that
437 * . if capable(cap_sys_nice), then those actions should be allowed
438 * . if not capable(cap_sys_nice), but acting on your own processes,
439 * then those actions should be allowed
440 * This is insufficient now since you can call code without suid, but
441 * yet with increased caps.
442 * So we check for increased caps on the target process.
444 static inline int cap_safe_nice(struct task_struct
*p
)
446 if (!cap_issubset(p
->cap_permitted
, current
->cap_permitted
) &&
447 !__capable(current
, CAP_SYS_NICE
))
452 int cap_task_setscheduler (struct task_struct
*p
, int policy
,
453 struct sched_param
*lp
)
455 return cap_safe_nice(p
);
458 int cap_task_setioprio (struct task_struct
*p
, int ioprio
)
460 return cap_safe_nice(p
);
463 int cap_task_setnice (struct task_struct
*p
, int nice
)
465 return cap_safe_nice(p
);
468 int cap_task_kill(struct task_struct
*p
, struct siginfo
*info
,
471 if (info
!= SEND_SIG_NOINFO
&& (is_si_special(info
) || SI_FROMKERNEL(info
)))
476 * Signal sent as a particular user.
477 * Capabilities are ignored. May be wrong, but it's the
478 * only thing we can do at the moment.
479 * Used only by usb drivers?
482 if (cap_issubset(p
->cap_permitted
, current
->cap_permitted
))
484 if (capable(CAP_KILL
))
490 int cap_task_setscheduler (struct task_struct
*p
, int policy
,
491 struct sched_param
*lp
)
495 int cap_task_setioprio (struct task_struct
*p
, int ioprio
)
499 int cap_task_setnice (struct task_struct
*p
, int nice
)
503 int cap_task_kill(struct task_struct
*p
, struct siginfo
*info
,
510 void cap_task_reparent_to_init (struct task_struct
*p
)
512 p
->cap_effective
= CAP_INIT_EFF_SET
;
513 p
->cap_inheritable
= CAP_INIT_INH_SET
;
514 p
->cap_permitted
= CAP_FULL_SET
;
515 p
->keep_capabilities
= 0;
519 int cap_syslog (int type
)
521 if ((type
!= 3 && type
!= 10) && !capable(CAP_SYS_ADMIN
))
526 int cap_vm_enough_memory(struct mm_struct
*mm
, long pages
)
528 int cap_sys_admin
= 0;
530 if (cap_capable(current
, CAP_SYS_ADMIN
) == 0)
532 return __vm_enough_memory(mm
, pages
, cap_sys_admin
);
535 EXPORT_SYMBOL(cap_capable
);
536 EXPORT_SYMBOL(cap_settime
);
537 EXPORT_SYMBOL(cap_ptrace
);
538 EXPORT_SYMBOL(cap_capget
);
539 EXPORT_SYMBOL(cap_capset_check
);
540 EXPORT_SYMBOL(cap_capset_set
);
541 EXPORT_SYMBOL(cap_bprm_set_security
);
542 EXPORT_SYMBOL(cap_bprm_apply_creds
);
543 EXPORT_SYMBOL(cap_bprm_secureexec
);
544 EXPORT_SYMBOL(cap_inode_setxattr
);
545 EXPORT_SYMBOL(cap_inode_removexattr
);
546 EXPORT_SYMBOL(cap_task_post_setuid
);
547 EXPORT_SYMBOL(cap_task_kill
);
548 EXPORT_SYMBOL(cap_task_setscheduler
);
549 EXPORT_SYMBOL(cap_task_setioprio
);
550 EXPORT_SYMBOL(cap_task_setnice
);
551 EXPORT_SYMBOL(cap_task_reparent_to_init
);
552 EXPORT_SYMBOL(cap_syslog
);
553 EXPORT_SYMBOL(cap_vm_enough_memory
);