1 /* 2 * linux/kernel/capability.c 3 * 4 * Copyright (C) 1997 Andrew Main <zefram@fysh.org> 5 * 6 * Integrated into 2.1.97+, Andrew G. Morgan <morgan@kernel.org> 7 * 30 May 2002: Cleanup, Robert M. Love <rml@tech9.net> 8 */ 9 10 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 11 12 #include <linux/audit.h> 13 #include <linux/capability.h> 14 #include <linux/mm.h> 15 #include <linux/export.h> 16 #include <linux/security.h> 17 #include <linux/syscalls.h> 18 #include <linux/pid_namespace.h> 19 #include <linux/user_namespace.h> 20 #include <asm/uaccess.h> 21 22 /* 23 * Leveraged for setting/resetting capabilities 24 */ 25 26 const kernel_cap_t __cap_empty_set = CAP_EMPTY_SET; 27 EXPORT_SYMBOL(__cap_empty_set); 28 29 int file_caps_enabled = 1; 30 31 static int __init file_caps_disable(char *str) 32 { 33 file_caps_enabled = 0; 34 return 1; 35 } 36 __setup("no_file_caps", file_caps_disable); 37 38 /* 39 * More recent versions of libcap are available from: 40 * 41 * http://www.kernel.org/pub/linux/libs/security/linux-privs/ 42 */ 43 44 static void warn_legacy_capability_use(void) 45 { 46 char name[sizeof(current->comm)]; 47 48 pr_info_once("warning: `%s' uses 32-bit capabilities (legacy support in use)\n", 49 get_task_comm(name, current)); 50 } 51 52 /* 53 * Version 2 capabilities worked fine, but the linux/capability.h file 54 * that accompanied their introduction encouraged their use without 55 * the necessary user-space source code changes. As such, we have 56 * created a version 3 with equivalent functionality to version 2, but 57 * with a header change to protect legacy source code from using 58 * version 2 when it wanted to use version 1. If your system has code 59 * that trips the following warning, it is using version 2 specific 60 * capabilities and may be doing so insecurely. 61 * 62 * The remedy is to either upgrade your version of libcap (to 2.10+, 63 * if the application is linked against it), or recompile your 64 * application with modern kernel headers and this warning will go 65 * away. 66 */ 67 68 static void warn_deprecated_v2(void) 69 { 70 char name[sizeof(current->comm)]; 71 72 pr_info_once("warning: `%s' uses deprecated v2 capabilities in a way that may be insecure\n", 73 get_task_comm(name, current)); 74 } 75 76 /* 77 * Version check. Return the number of u32s in each capability flag 78 * array, or a negative value on error. 79 */ 80 static int cap_validate_magic(cap_user_header_t header, unsigned *tocopy) 81 { 82 __u32 version; 83 84 if (get_user(version, &header->version)) 85 return -EFAULT; 86 87 switch (version) { 88 case _LINUX_CAPABILITY_VERSION_1: 89 warn_legacy_capability_use(); 90 *tocopy = _LINUX_CAPABILITY_U32S_1; 91 break; 92 case _LINUX_CAPABILITY_VERSION_2: 93 warn_deprecated_v2(); 94 /* 95 * fall through - v3 is otherwise equivalent to v2. 96 */ 97 case _LINUX_CAPABILITY_VERSION_3: 98 *tocopy = _LINUX_CAPABILITY_U32S_3; 99 break; 100 default: 101 if (put_user((u32)_KERNEL_CAPABILITY_VERSION, &header->version)) 102 return -EFAULT; 103 return -EINVAL; 104 } 105 106 return 0; 107 } 108 109 /* 110 * The only thing that can change the capabilities of the current 111 * process is the current process. As such, we can't be in this code 112 * at the same time as we are in the process of setting capabilities 113 * in this process. The net result is that we can limit our use of 114 * locks to when we are reading the caps of another process. 115 */ 116 static inline int cap_get_target_pid(pid_t pid, kernel_cap_t *pEp, 117 kernel_cap_t *pIp, kernel_cap_t *pPp) 118 { 119 int ret; 120 121 if (pid && (pid != task_pid_vnr(current))) { 122 struct task_struct *target; 123 124 rcu_read_lock(); 125 126 target = find_task_by_vpid(pid); 127 if (!target) 128 ret = -ESRCH; 129 else 130 ret = security_capget(target, pEp, pIp, pPp); 131 132 rcu_read_unlock(); 133 } else 134 ret = security_capget(current, pEp, pIp, pPp); 135 136 return ret; 137 } 138 139 /** 140 * sys_capget - get the capabilities of a given process. 141 * @header: pointer to struct that contains capability version and 142 * target pid data 143 * @dataptr: pointer to struct that contains the effective, permitted, 144 * and inheritable capabilities that are returned 145 * 146 * Returns 0 on success and < 0 on error. 147 */ 148 SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr) 149 { 150 int ret = 0; 151 pid_t pid; 152 unsigned tocopy; 153 kernel_cap_t pE, pI, pP; 154 155 ret = cap_validate_magic(header, &tocopy); 156 if ((dataptr == NULL) || (ret != 0)) 157 return ((dataptr == NULL) && (ret == -EINVAL)) ? 0 : ret; 158 159 if (get_user(pid, &header->pid)) 160 return -EFAULT; 161 162 if (pid < 0) 163 return -EINVAL; 164 165 ret = cap_get_target_pid(pid, &pE, &pI, &pP); 166 if (!ret) { 167 struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S]; 168 unsigned i; 169 170 for (i = 0; i < tocopy; i++) { 171 kdata[i].effective = pE.cap[i]; 172 kdata[i].permitted = pP.cap[i]; 173 kdata[i].inheritable = pI.cap[i]; 174 } 175 176 /* 177 * Note, in the case, tocopy < _KERNEL_CAPABILITY_U32S, 178 * we silently drop the upper capabilities here. This 179 * has the effect of making older libcap 180 * implementations implicitly drop upper capability 181 * bits when they perform a: capget/modify/capset 182 * sequence. 183 * 184 * This behavior is considered fail-safe 185 * behavior. Upgrading the application to a newer 186 * version of libcap will enable access to the newer 187 * capabilities. 188 * 189 * An alternative would be to return an error here 190 * (-ERANGE), but that causes legacy applications to 191 * unexpectedly fail; the capget/modify/capset aborts 192 * before modification is attempted and the application 193 * fails. 194 */ 195 if (copy_to_user(dataptr, kdata, tocopy 196 * sizeof(struct __user_cap_data_struct))) { 197 return -EFAULT; 198 } 199 } 200 201 return ret; 202 } 203 204 /** 205 * sys_capset - set capabilities for a process or (*) a group of processes 206 * @header: pointer to struct that contains capability version and 207 * target pid data 208 * @data: pointer to struct that contains the effective, permitted, 209 * and inheritable capabilities 210 * 211 * Set capabilities for the current process only. The ability to any other 212 * process(es) has been deprecated and removed. 213 * 214 * The restrictions on setting capabilities are specified as: 215 * 216 * I: any raised capabilities must be a subset of the old permitted 217 * P: any raised capabilities must be a subset of the old permitted 218 * E: must be set to a subset of new permitted 219 * 220 * Returns 0 on success and < 0 on error. 221 */ 222 SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data) 223 { 224 struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S]; 225 unsigned i, tocopy, copybytes; 226 kernel_cap_t inheritable, permitted, effective; 227 struct cred *new; 228 int ret; 229 pid_t pid; 230 231 ret = cap_validate_magic(header, &tocopy); 232 if (ret != 0) 233 return ret; 234 235 if (get_user(pid, &header->pid)) 236 return -EFAULT; 237 238 /* may only affect current now */ 239 if (pid != 0 && pid != task_pid_vnr(current)) 240 return -EPERM; 241 242 copybytes = tocopy * sizeof(struct __user_cap_data_struct); 243 if (copybytes > sizeof(kdata)) 244 return -EFAULT; 245 246 if (copy_from_user(&kdata, data, copybytes)) 247 return -EFAULT; 248 249 for (i = 0; i < tocopy; i++) { 250 effective.cap[i] = kdata[i].effective; 251 permitted.cap[i] = kdata[i].permitted; 252 inheritable.cap[i] = kdata[i].inheritable; 253 } 254 while (i < _KERNEL_CAPABILITY_U32S) { 255 effective.cap[i] = 0; 256 permitted.cap[i] = 0; 257 inheritable.cap[i] = 0; 258 i++; 259 } 260 261 new = prepare_creds(); 262 if (!new) 263 return -ENOMEM; 264 265 ret = security_capset(new, current_cred(), 266 &effective, &inheritable, &permitted); 267 if (ret < 0) 268 goto error; 269 270 audit_log_capset(new, current_cred()); 271 272 return commit_creds(new); 273 274 error: 275 abort_creds(new); 276 return ret; 277 } 278 279 /** 280 * has_ns_capability - Does a task have a capability in a specific user ns 281 * @t: The task in question 282 * @ns: target user namespace 283 * @cap: The capability to be tested for 284 * 285 * Return true if the specified task has the given superior capability 286 * currently in effect to the specified user namespace, false if not. 287 * 288 * Note that this does not set PF_SUPERPRIV on the task. 289 */ 290 bool has_ns_capability(struct task_struct *t, 291 struct user_namespace *ns, int cap) 292 { 293 int ret; 294 295 rcu_read_lock(); 296 ret = security_capable(__task_cred(t), ns, cap); 297 rcu_read_unlock(); 298 299 return (ret == 0); 300 } 301 302 /** 303 * has_capability - Does a task have a capability in init_user_ns 304 * @t: The task in question 305 * @cap: The capability to be tested for 306 * 307 * Return true if the specified task has the given superior capability 308 * currently in effect to the initial user namespace, false if not. 309 * 310 * Note that this does not set PF_SUPERPRIV on the task. 311 */ 312 bool has_capability(struct task_struct *t, int cap) 313 { 314 return has_ns_capability(t, &init_user_ns, cap); 315 } 316 317 /** 318 * has_ns_capability_noaudit - Does a task have a capability (unaudited) 319 * in a specific user ns. 320 * @t: The task in question 321 * @ns: target user namespace 322 * @cap: The capability to be tested for 323 * 324 * Return true if the specified task has the given superior capability 325 * currently in effect to the specified user namespace, false if not. 326 * Do not write an audit message for the check. 327 * 328 * Note that this does not set PF_SUPERPRIV on the task. 329 */ 330 bool has_ns_capability_noaudit(struct task_struct *t, 331 struct user_namespace *ns, int cap) 332 { 333 int ret; 334 335 rcu_read_lock(); 336 ret = security_capable_noaudit(__task_cred(t), ns, cap); 337 rcu_read_unlock(); 338 339 return (ret == 0); 340 } 341 342 /** 343 * has_capability_noaudit - Does a task have a capability (unaudited) in the 344 * initial user ns 345 * @t: The task in question 346 * @cap: The capability to be tested for 347 * 348 * Return true if the specified task has the given superior capability 349 * currently in effect to init_user_ns, false if not. Don't write an 350 * audit message for the check. 351 * 352 * Note that this does not set PF_SUPERPRIV on the task. 353 */ 354 bool has_capability_noaudit(struct task_struct *t, int cap) 355 { 356 return has_ns_capability_noaudit(t, &init_user_ns, cap); 357 } 358 359 /** 360 * ns_capable - Determine if the current task has a superior capability in effect 361 * @ns: The usernamespace we want the capability in 362 * @cap: The capability to be tested for 363 * 364 * Return true if the current task has the given superior capability currently 365 * available for use, false if not. 366 * 367 * This sets PF_SUPERPRIV on the task if the capability is available on the 368 * assumption that it's about to be used. 369 */ 370 bool ns_capable(struct user_namespace *ns, int cap) 371 { 372 if (unlikely(!cap_valid(cap))) { 373 pr_crit("capable() called with invalid cap=%u\n", cap); 374 BUG(); 375 } 376 377 if (security_capable(current_cred(), ns, cap) == 0) { 378 current->flags |= PF_SUPERPRIV; 379 return true; 380 } 381 return false; 382 } 383 EXPORT_SYMBOL(ns_capable); 384 385 /** 386 * file_ns_capable - Determine if the file's opener had a capability in effect 387 * @file: The file we want to check 388 * @ns: The usernamespace we want the capability in 389 * @cap: The capability to be tested for 390 * 391 * Return true if task that opened the file had a capability in effect 392 * when the file was opened. 393 * 394 * This does not set PF_SUPERPRIV because the caller may not 395 * actually be privileged. 396 */ 397 bool file_ns_capable(const struct file *file, struct user_namespace *ns, 398 int cap) 399 { 400 if (WARN_ON_ONCE(!cap_valid(cap))) 401 return false; 402 403 if (security_capable(file->f_cred, ns, cap) == 0) 404 return true; 405 406 return false; 407 } 408 EXPORT_SYMBOL(file_ns_capable); 409 410 /** 411 * capable - Determine if the current task has a superior capability in effect 412 * @cap: The capability to be tested for 413 * 414 * Return true if the current task has the given superior capability currently 415 * available for use, false if not. 416 * 417 * This sets PF_SUPERPRIV on the task if the capability is available on the 418 * assumption that it's about to be used. 419 */ 420 bool capable(int cap) 421 { 422 return ns_capable(&init_user_ns, cap); 423 } 424 EXPORT_SYMBOL(capable); 425 426 /** 427 * capable_wrt_inode_uidgid - Check nsown_capable and uid and gid mapped 428 * @inode: The inode in question 429 * @cap: The capability in question 430 * 431 * Return true if the current task has the given capability targeted at 432 * its own user namespace and that the given inode's uid and gid are 433 * mapped into the current user namespace. 434 */ 435 bool capable_wrt_inode_uidgid(const struct inode *inode, int cap) 436 { 437 struct user_namespace *ns = current_user_ns(); 438 439 return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid) && 440 kgid_has_mapping(ns, inode->i_gid); 441 } 442 EXPORT_SYMBOL(capable_wrt_inode_uidgid); 443