xref: /openbmc/linux/security/commoncap.c (revision e8e0929d)
1 /* Common capabilities, needed by capability.o and root_plug.o
2  *
3  *	This program is free software; you can redistribute it and/or modify
4  *	it under the terms of the GNU General Public License as published by
5  *	the Free Software Foundation; either version 2 of the License, or
6  *	(at your option) any later version.
7  *
8  */
9 
10 #include <linux/capability.h>
11 #include <linux/audit.h>
12 #include <linux/module.h>
13 #include <linux/init.h>
14 #include <linux/kernel.h>
15 #include <linux/security.h>
16 #include <linux/file.h>
17 #include <linux/mm.h>
18 #include <linux/mman.h>
19 #include <linux/pagemap.h>
20 #include <linux/swap.h>
21 #include <linux/skbuff.h>
22 #include <linux/netlink.h>
23 #include <linux/ptrace.h>
24 #include <linux/xattr.h>
25 #include <linux/hugetlb.h>
26 #include <linux/mount.h>
27 #include <linux/sched.h>
28 #include <linux/prctl.h>
29 #include <linux/securebits.h>
30 
31 /*
32  * If a non-root user executes a setuid-root binary in
33  * !secure(SECURE_NOROOT) mode, then we raise capabilities.
34  * However if fE is also set, then the intent is for only
35  * the file capabilities to be applied, and the setuid-root
36  * bit is left on either to change the uid (plausible) or
37  * to get full privilege on a kernel without file capabilities
38  * support.  So in that case we do not raise capabilities.
39  *
40  * Warn if that happens, once per boot.
41  */
42 static void warn_setuid_and_fcaps_mixed(char *fname)
43 {
44 	static int warned;
45 	if (!warned) {
46 		printk(KERN_INFO "warning: `%s' has both setuid-root and"
47 			" effective capabilities. Therefore not raising all"
48 			" capabilities.\n", fname);
49 		warned = 1;
50 	}
51 }
52 
53 int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
54 {
55 	NETLINK_CB(skb).eff_cap = current_cap();
56 	return 0;
57 }
58 
59 int cap_netlink_recv(struct sk_buff *skb, int cap)
60 {
61 	if (!cap_raised(NETLINK_CB(skb).eff_cap, cap))
62 		return -EPERM;
63 	return 0;
64 }
65 EXPORT_SYMBOL(cap_netlink_recv);
66 
67 /**
68  * cap_capable - Determine whether a task has a particular effective capability
69  * @tsk: The task to query
70  * @cred: The credentials to use
71  * @cap: The capability to check for
72  * @audit: Whether to write an audit message or not
73  *
74  * Determine whether the nominated task has the specified capability amongst
75  * its effective set, returning 0 if it does, -ve if it does not.
76  *
77  * NOTE WELL: cap_has_capability() cannot be used like the kernel's capable()
78  * and has_capability() functions.  That is, it has the reverse semantics:
79  * cap_has_capability() returns 0 when a task has a capability, but the
80  * kernel's capable() and has_capability() returns 1 for this case.
81  */
82 int cap_capable(struct task_struct *tsk, const struct cred *cred, int cap,
83 		int audit)
84 {
85 	return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
86 }
87 
88 /**
89  * cap_settime - Determine whether the current process may set the system clock
90  * @ts: The time to set
91  * @tz: The timezone to set
92  *
93  * Determine whether the current process may set the system clock and timezone
94  * information, returning 0 if permission granted, -ve if denied.
95  */
96 int cap_settime(struct timespec *ts, struct timezone *tz)
97 {
98 	if (!capable(CAP_SYS_TIME))
99 		return -EPERM;
100 	return 0;
101 }
102 
103 /**
104  * cap_ptrace_access_check - Determine whether the current process may access
105  *			   another
106  * @child: The process to be accessed
107  * @mode: The mode of attachment.
108  *
109  * Determine whether a process may access another, returning 0 if permission
110  * granted, -ve if denied.
111  */
112 int cap_ptrace_access_check(struct task_struct *child, unsigned int mode)
113 {
114 	int ret = 0;
115 
116 	rcu_read_lock();
117 	if (!cap_issubset(__task_cred(child)->cap_permitted,
118 			  current_cred()->cap_permitted) &&
119 	    !capable(CAP_SYS_PTRACE))
120 		ret = -EPERM;
121 	rcu_read_unlock();
122 	return ret;
123 }
124 
125 /**
126  * cap_ptrace_traceme - Determine whether another process may trace the current
127  * @parent: The task proposed to be the tracer
128  *
129  * Determine whether the nominated task is permitted to trace the current
130  * process, returning 0 if permission is granted, -ve if denied.
131  */
132 int cap_ptrace_traceme(struct task_struct *parent)
133 {
134 	int ret = 0;
135 
136 	rcu_read_lock();
137 	if (!cap_issubset(current_cred()->cap_permitted,
138 			  __task_cred(parent)->cap_permitted) &&
139 	    !has_capability(parent, CAP_SYS_PTRACE))
140 		ret = -EPERM;
141 	rcu_read_unlock();
142 	return ret;
143 }
144 
145 /**
146  * cap_capget - Retrieve a task's capability sets
147  * @target: The task from which to retrieve the capability sets
148  * @effective: The place to record the effective set
149  * @inheritable: The place to record the inheritable set
150  * @permitted: The place to record the permitted set
151  *
152  * This function retrieves the capabilities of the nominated task and returns
153  * them to the caller.
154  */
155 int cap_capget(struct task_struct *target, kernel_cap_t *effective,
156 	       kernel_cap_t *inheritable, kernel_cap_t *permitted)
157 {
158 	const struct cred *cred;
159 
160 	/* Derived from kernel/capability.c:sys_capget. */
161 	rcu_read_lock();
162 	cred = __task_cred(target);
163 	*effective   = cred->cap_effective;
164 	*inheritable = cred->cap_inheritable;
165 	*permitted   = cred->cap_permitted;
166 	rcu_read_unlock();
167 	return 0;
168 }
169 
170 /*
171  * Determine whether the inheritable capabilities are limited to the old
172  * permitted set.  Returns 1 if they are limited, 0 if they are not.
173  */
174 static inline int cap_inh_is_capped(void)
175 {
176 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
177 
178 	/* they are so limited unless the current task has the CAP_SETPCAP
179 	 * capability
180 	 */
181 	if (cap_capable(current, current_cred(), CAP_SETPCAP,
182 			SECURITY_CAP_AUDIT) == 0)
183 		return 0;
184 #endif
185 	return 1;
186 }
187 
188 /**
189  * cap_capset - Validate and apply proposed changes to current's capabilities
190  * @new: The proposed new credentials; alterations should be made here
191  * @old: The current task's current credentials
192  * @effective: A pointer to the proposed new effective capabilities set
193  * @inheritable: A pointer to the proposed new inheritable capabilities set
194  * @permitted: A pointer to the proposed new permitted capabilities set
195  *
196  * This function validates and applies a proposed mass change to the current
197  * process's capability sets.  The changes are made to the proposed new
198  * credentials, and assuming no error, will be committed by the caller of LSM.
199  */
200 int cap_capset(struct cred *new,
201 	       const struct cred *old,
202 	       const kernel_cap_t *effective,
203 	       const kernel_cap_t *inheritable,
204 	       const kernel_cap_t *permitted)
205 {
206 	if (cap_inh_is_capped() &&
207 	    !cap_issubset(*inheritable,
208 			  cap_combine(old->cap_inheritable,
209 				      old->cap_permitted)))
210 		/* incapable of using this inheritable set */
211 		return -EPERM;
212 
213 	if (!cap_issubset(*inheritable,
214 			  cap_combine(old->cap_inheritable,
215 				      old->cap_bset)))
216 		/* no new pI capabilities outside bounding set */
217 		return -EPERM;
218 
219 	/* verify restrictions on target's new Permitted set */
220 	if (!cap_issubset(*permitted, old->cap_permitted))
221 		return -EPERM;
222 
223 	/* verify the _new_Effective_ is a subset of the _new_Permitted_ */
224 	if (!cap_issubset(*effective, *permitted))
225 		return -EPERM;
226 
227 	new->cap_effective   = *effective;
228 	new->cap_inheritable = *inheritable;
229 	new->cap_permitted   = *permitted;
230 	return 0;
231 }
232 
233 /*
234  * Clear proposed capability sets for execve().
235  */
236 static inline void bprm_clear_caps(struct linux_binprm *bprm)
237 {
238 	cap_clear(bprm->cred->cap_permitted);
239 	bprm->cap_effective = false;
240 }
241 
242 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
243 
244 /**
245  * cap_inode_need_killpriv - Determine if inode change affects privileges
246  * @dentry: The inode/dentry in being changed with change marked ATTR_KILL_PRIV
247  *
248  * Determine if an inode having a change applied that's marked ATTR_KILL_PRIV
249  * affects the security markings on that inode, and if it is, should
250  * inode_killpriv() be invoked or the change rejected?
251  *
252  * Returns 0 if granted; +ve if granted, but inode_killpriv() is required; and
253  * -ve to deny the change.
254  */
255 int cap_inode_need_killpriv(struct dentry *dentry)
256 {
257 	struct inode *inode = dentry->d_inode;
258 	int error;
259 
260 	if (!inode->i_op->getxattr)
261 	       return 0;
262 
263 	error = inode->i_op->getxattr(dentry, XATTR_NAME_CAPS, NULL, 0);
264 	if (error <= 0)
265 		return 0;
266 	return 1;
267 }
268 
269 /**
270  * cap_inode_killpriv - Erase the security markings on an inode
271  * @dentry: The inode/dentry to alter
272  *
273  * Erase the privilege-enhancing security markings on an inode.
274  *
275  * Returns 0 if successful, -ve on error.
276  */
277 int cap_inode_killpriv(struct dentry *dentry)
278 {
279 	struct inode *inode = dentry->d_inode;
280 
281 	if (!inode->i_op->removexattr)
282 	       return 0;
283 
284 	return inode->i_op->removexattr(dentry, XATTR_NAME_CAPS);
285 }
286 
287 /*
288  * Calculate the new process capability sets from the capability sets attached
289  * to a file.
290  */
291 static inline int bprm_caps_from_vfs_caps(struct cpu_vfs_cap_data *caps,
292 					  struct linux_binprm *bprm,
293 					  bool *effective)
294 {
295 	struct cred *new = bprm->cred;
296 	unsigned i;
297 	int ret = 0;
298 
299 	if (caps->magic_etc & VFS_CAP_FLAGS_EFFECTIVE)
300 		*effective = true;
301 
302 	CAP_FOR_EACH_U32(i) {
303 		__u32 permitted = caps->permitted.cap[i];
304 		__u32 inheritable = caps->inheritable.cap[i];
305 
306 		/*
307 		 * pP' = (X & fP) | (pI & fI)
308 		 */
309 		new->cap_permitted.cap[i] =
310 			(new->cap_bset.cap[i] & permitted) |
311 			(new->cap_inheritable.cap[i] & inheritable);
312 
313 		if (permitted & ~new->cap_permitted.cap[i])
314 			/* insufficient to execute correctly */
315 			ret = -EPERM;
316 	}
317 
318 	/*
319 	 * For legacy apps, with no internal support for recognizing they
320 	 * do not have enough capabilities, we return an error if they are
321 	 * missing some "forced" (aka file-permitted) capabilities.
322 	 */
323 	return *effective ? ret : 0;
324 }
325 
326 /*
327  * Extract the on-exec-apply capability sets for an executable file.
328  */
329 int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps)
330 {
331 	struct inode *inode = dentry->d_inode;
332 	__u32 magic_etc;
333 	unsigned tocopy, i;
334 	int size;
335 	struct vfs_cap_data caps;
336 
337 	memset(cpu_caps, 0, sizeof(struct cpu_vfs_cap_data));
338 
339 	if (!inode || !inode->i_op->getxattr)
340 		return -ENODATA;
341 
342 	size = inode->i_op->getxattr((struct dentry *)dentry, XATTR_NAME_CAPS, &caps,
343 				   XATTR_CAPS_SZ);
344 	if (size == -ENODATA || size == -EOPNOTSUPP)
345 		/* no data, that's ok */
346 		return -ENODATA;
347 	if (size < 0)
348 		return size;
349 
350 	if (size < sizeof(magic_etc))
351 		return -EINVAL;
352 
353 	cpu_caps->magic_etc = magic_etc = le32_to_cpu(caps.magic_etc);
354 
355 	switch (magic_etc & VFS_CAP_REVISION_MASK) {
356 	case VFS_CAP_REVISION_1:
357 		if (size != XATTR_CAPS_SZ_1)
358 			return -EINVAL;
359 		tocopy = VFS_CAP_U32_1;
360 		break;
361 	case VFS_CAP_REVISION_2:
362 		if (size != XATTR_CAPS_SZ_2)
363 			return -EINVAL;
364 		tocopy = VFS_CAP_U32_2;
365 		break;
366 	default:
367 		return -EINVAL;
368 	}
369 
370 	CAP_FOR_EACH_U32(i) {
371 		if (i >= tocopy)
372 			break;
373 		cpu_caps->permitted.cap[i] = le32_to_cpu(caps.data[i].permitted);
374 		cpu_caps->inheritable.cap[i] = le32_to_cpu(caps.data[i].inheritable);
375 	}
376 
377 	return 0;
378 }
379 
380 /*
381  * Attempt to get the on-exec apply capability sets for an executable file from
382  * its xattrs and, if present, apply them to the proposed credentials being
383  * constructed by execve().
384  */
385 static int get_file_caps(struct linux_binprm *bprm, bool *effective)
386 {
387 	struct dentry *dentry;
388 	int rc = 0;
389 	struct cpu_vfs_cap_data vcaps;
390 
391 	bprm_clear_caps(bprm);
392 
393 	if (!file_caps_enabled)
394 		return 0;
395 
396 	if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
397 		return 0;
398 
399 	dentry = dget(bprm->file->f_dentry);
400 
401 	rc = get_vfs_caps_from_disk(dentry, &vcaps);
402 	if (rc < 0) {
403 		if (rc == -EINVAL)
404 			printk(KERN_NOTICE "%s: get_vfs_caps_from_disk returned %d for %s\n",
405 				__func__, rc, bprm->filename);
406 		else if (rc == -ENODATA)
407 			rc = 0;
408 		goto out;
409 	}
410 
411 	rc = bprm_caps_from_vfs_caps(&vcaps, bprm, effective);
412 	if (rc == -EINVAL)
413 		printk(KERN_NOTICE "%s: cap_from_disk returned %d for %s\n",
414 		       __func__, rc, bprm->filename);
415 
416 out:
417 	dput(dentry);
418 	if (rc)
419 		bprm_clear_caps(bprm);
420 
421 	return rc;
422 }
423 
424 #else
425 int cap_inode_need_killpriv(struct dentry *dentry)
426 {
427 	return 0;
428 }
429 
430 int cap_inode_killpriv(struct dentry *dentry)
431 {
432 	return 0;
433 }
434 
435 int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps)
436 {
437 	memset(cpu_caps, 0, sizeof(struct cpu_vfs_cap_data));
438  	return -ENODATA;
439 }
440 
441 static inline int get_file_caps(struct linux_binprm *bprm, bool *effective)
442 {
443 	bprm_clear_caps(bprm);
444 	return 0;
445 }
446 #endif
447 
448 /*
449  * Determine whether a exec'ing process's new permitted capabilities should be
450  * limited to just what it already has.
451  *
452  * This prevents processes that are being ptraced from gaining access to
453  * CAP_SETPCAP, unless the process they're tracing already has it, and the
454  * binary they're executing has filecaps that elevate it.
455  *
456  *  Returns 1 if they should be limited, 0 if they are not.
457  */
458 static inline int cap_limit_ptraced_target(void)
459 {
460 #ifndef CONFIG_SECURITY_FILE_CAPABILITIES
461 	if (capable(CAP_SETPCAP))
462 		return 0;
463 #endif
464 	return 1;
465 }
466 
467 /**
468  * cap_bprm_set_creds - Set up the proposed credentials for execve().
469  * @bprm: The execution parameters, including the proposed creds
470  *
471  * Set up the proposed credentials for a new execution context being
472  * constructed by execve().  The proposed creds in @bprm->cred is altered,
473  * which won't take effect immediately.  Returns 0 if successful, -ve on error.
474  */
475 int cap_bprm_set_creds(struct linux_binprm *bprm)
476 {
477 	const struct cred *old = current_cred();
478 	struct cred *new = bprm->cred;
479 	bool effective;
480 	int ret;
481 
482 	effective = false;
483 	ret = get_file_caps(bprm, &effective);
484 	if (ret < 0)
485 		return ret;
486 
487 	if (!issecure(SECURE_NOROOT)) {
488 		/*
489 		 * If the legacy file capability is set, then don't set privs
490 		 * for a setuid root binary run by a non-root user.  Do set it
491 		 * for a root user just to cause least surprise to an admin.
492 		 */
493 		if (effective && new->uid != 0 && new->euid == 0) {
494 			warn_setuid_and_fcaps_mixed(bprm->filename);
495 			goto skip;
496 		}
497 		/*
498 		 * To support inheritance of root-permissions and suid-root
499 		 * executables under compatibility mode, we override the
500 		 * capability sets for the file.
501 		 *
502 		 * If only the real uid is 0, we do not set the effective bit.
503 		 */
504 		if (new->euid == 0 || new->uid == 0) {
505 			/* pP' = (cap_bset & ~0) | (pI & ~0) */
506 			new->cap_permitted = cap_combine(old->cap_bset,
507 							 old->cap_inheritable);
508 		}
509 		if (new->euid == 0)
510 			effective = true;
511 	}
512 skip:
513 
514 	/* Don't let someone trace a set[ug]id/setpcap binary with the revised
515 	 * credentials unless they have the appropriate permit
516 	 */
517 	if ((new->euid != old->uid ||
518 	     new->egid != old->gid ||
519 	     !cap_issubset(new->cap_permitted, old->cap_permitted)) &&
520 	    bprm->unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
521 		/* downgrade; they get no more than they had, and maybe less */
522 		if (!capable(CAP_SETUID)) {
523 			new->euid = new->uid;
524 			new->egid = new->gid;
525 		}
526 		if (cap_limit_ptraced_target())
527 			new->cap_permitted = cap_intersect(new->cap_permitted,
528 							   old->cap_permitted);
529 	}
530 
531 	new->suid = new->fsuid = new->euid;
532 	new->sgid = new->fsgid = new->egid;
533 
534 	/* For init, we want to retain the capabilities set in the initial
535 	 * task.  Thus we skip the usual capability rules
536 	 */
537 	if (!is_global_init(current)) {
538 		if (effective)
539 			new->cap_effective = new->cap_permitted;
540 		else
541 			cap_clear(new->cap_effective);
542 	}
543 	bprm->cap_effective = effective;
544 
545 	/*
546 	 * Audit candidate if current->cap_effective is set
547 	 *
548 	 * We do not bother to audit if 3 things are true:
549 	 *   1) cap_effective has all caps
550 	 *   2) we are root
551 	 *   3) root is supposed to have all caps (SECURE_NOROOT)
552 	 * Since this is just a normal root execing a process.
553 	 *
554 	 * Number 1 above might fail if you don't have a full bset, but I think
555 	 * that is interesting information to audit.
556 	 */
557 	if (!cap_isclear(new->cap_effective)) {
558 		if (!cap_issubset(CAP_FULL_SET, new->cap_effective) ||
559 		    new->euid != 0 || new->uid != 0 ||
560 		    issecure(SECURE_NOROOT)) {
561 			ret = audit_log_bprm_fcaps(bprm, new, old);
562 			if (ret < 0)
563 				return ret;
564 		}
565 	}
566 
567 	new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
568 	return 0;
569 }
570 
571 /**
572  * cap_bprm_secureexec - Determine whether a secure execution is required
573  * @bprm: The execution parameters
574  *
575  * Determine whether a secure execution is required, return 1 if it is, and 0
576  * if it is not.
577  *
578  * The credentials have been committed by this point, and so are no longer
579  * available through @bprm->cred.
580  */
581 int cap_bprm_secureexec(struct linux_binprm *bprm)
582 {
583 	const struct cred *cred = current_cred();
584 
585 	if (cred->uid != 0) {
586 		if (bprm->cap_effective)
587 			return 1;
588 		if (!cap_isclear(cred->cap_permitted))
589 			return 1;
590 	}
591 
592 	return (cred->euid != cred->uid ||
593 		cred->egid != cred->gid);
594 }
595 
596 /**
597  * cap_inode_setxattr - Determine whether an xattr may be altered
598  * @dentry: The inode/dentry being altered
599  * @name: The name of the xattr to be changed
600  * @value: The value that the xattr will be changed to
601  * @size: The size of value
602  * @flags: The replacement flag
603  *
604  * Determine whether an xattr may be altered or set on an inode, returning 0 if
605  * permission is granted, -ve if denied.
606  *
607  * This is used to make sure security xattrs don't get updated or set by those
608  * who aren't privileged to do so.
609  */
610 int cap_inode_setxattr(struct dentry *dentry, const char *name,
611 		       const void *value, size_t size, int flags)
612 {
613 	if (!strcmp(name, XATTR_NAME_CAPS)) {
614 		if (!capable(CAP_SETFCAP))
615 			return -EPERM;
616 		return 0;
617 	}
618 
619 	if (!strncmp(name, XATTR_SECURITY_PREFIX,
620 		     sizeof(XATTR_SECURITY_PREFIX) - 1)  &&
621 	    !capable(CAP_SYS_ADMIN))
622 		return -EPERM;
623 	return 0;
624 }
625 
626 /**
627  * cap_inode_removexattr - Determine whether an xattr may be removed
628  * @dentry: The inode/dentry being altered
629  * @name: The name of the xattr to be changed
630  *
631  * Determine whether an xattr may be removed from an inode, returning 0 if
632  * permission is granted, -ve if denied.
633  *
634  * This is used to make sure security xattrs don't get removed by those who
635  * aren't privileged to remove them.
636  */
637 int cap_inode_removexattr(struct dentry *dentry, const char *name)
638 {
639 	if (!strcmp(name, XATTR_NAME_CAPS)) {
640 		if (!capable(CAP_SETFCAP))
641 			return -EPERM;
642 		return 0;
643 	}
644 
645 	if (!strncmp(name, XATTR_SECURITY_PREFIX,
646 		     sizeof(XATTR_SECURITY_PREFIX) - 1)  &&
647 	    !capable(CAP_SYS_ADMIN))
648 		return -EPERM;
649 	return 0;
650 }
651 
652 /*
653  * cap_emulate_setxuid() fixes the effective / permitted capabilities of
654  * a process after a call to setuid, setreuid, or setresuid.
655  *
656  *  1) When set*uiding _from_ one of {r,e,s}uid == 0 _to_ all of
657  *  {r,e,s}uid != 0, the permitted and effective capabilities are
658  *  cleared.
659  *
660  *  2) When set*uiding _from_ euid == 0 _to_ euid != 0, the effective
661  *  capabilities of the process are cleared.
662  *
663  *  3) When set*uiding _from_ euid != 0 _to_ euid == 0, the effective
664  *  capabilities are set to the permitted capabilities.
665  *
666  *  fsuid is handled elsewhere. fsuid == 0 and {r,e,s}uid!= 0 should
667  *  never happen.
668  *
669  *  -astor
670  *
671  * cevans - New behaviour, Oct '99
672  * A process may, via prctl(), elect to keep its capabilities when it
673  * calls setuid() and switches away from uid==0. Both permitted and
674  * effective sets will be retained.
675  * Without this change, it was impossible for a daemon to drop only some
676  * of its privilege. The call to setuid(!=0) would drop all privileges!
677  * Keeping uid 0 is not an option because uid 0 owns too many vital
678  * files..
679  * Thanks to Olaf Kirch and Peter Benie for spotting this.
680  */
681 static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)
682 {
683 	if ((old->uid == 0 || old->euid == 0 || old->suid == 0) &&
684 	    (new->uid != 0 && new->euid != 0 && new->suid != 0) &&
685 	    !issecure(SECURE_KEEP_CAPS)) {
686 		cap_clear(new->cap_permitted);
687 		cap_clear(new->cap_effective);
688 	}
689 	if (old->euid == 0 && new->euid != 0)
690 		cap_clear(new->cap_effective);
691 	if (old->euid != 0 && new->euid == 0)
692 		new->cap_effective = new->cap_permitted;
693 }
694 
695 /**
696  * cap_task_fix_setuid - Fix up the results of setuid() call
697  * @new: The proposed credentials
698  * @old: The current task's current credentials
699  * @flags: Indications of what has changed
700  *
701  * Fix up the results of setuid() call before the credential changes are
702  * actually applied, returning 0 to grant the changes, -ve to deny them.
703  */
704 int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
705 {
706 	switch (flags) {
707 	case LSM_SETID_RE:
708 	case LSM_SETID_ID:
709 	case LSM_SETID_RES:
710 		/* juggle the capabilities to follow [RES]UID changes unless
711 		 * otherwise suppressed */
712 		if (!issecure(SECURE_NO_SETUID_FIXUP))
713 			cap_emulate_setxuid(new, old);
714 		break;
715 
716 	case LSM_SETID_FS:
717 		/* juggle the capabilties to follow FSUID changes, unless
718 		 * otherwise suppressed
719 		 *
720 		 * FIXME - is fsuser used for all CAP_FS_MASK capabilities?
721 		 *          if not, we might be a bit too harsh here.
722 		 */
723 		if (!issecure(SECURE_NO_SETUID_FIXUP)) {
724 			if (old->fsuid == 0 && new->fsuid != 0)
725 				new->cap_effective =
726 					cap_drop_fs_set(new->cap_effective);
727 
728 			if (old->fsuid != 0 && new->fsuid == 0)
729 				new->cap_effective =
730 					cap_raise_fs_set(new->cap_effective,
731 							 new->cap_permitted);
732 		}
733 		break;
734 
735 	default:
736 		return -EINVAL;
737 	}
738 
739 	return 0;
740 }
741 
742 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
743 /*
744  * Rationale: code calling task_setscheduler, task_setioprio, and
745  * task_setnice, assumes that
746  *   . if capable(cap_sys_nice), then those actions should be allowed
747  *   . if not capable(cap_sys_nice), but acting on your own processes,
748  *   	then those actions should be allowed
749  * This is insufficient now since you can call code without suid, but
750  * yet with increased caps.
751  * So we check for increased caps on the target process.
752  */
753 static int cap_safe_nice(struct task_struct *p)
754 {
755 	int is_subset;
756 
757 	rcu_read_lock();
758 	is_subset = cap_issubset(__task_cred(p)->cap_permitted,
759 				 current_cred()->cap_permitted);
760 	rcu_read_unlock();
761 
762 	if (!is_subset && !capable(CAP_SYS_NICE))
763 		return -EPERM;
764 	return 0;
765 }
766 
767 /**
768  * cap_task_setscheduler - Detemine if scheduler policy change is permitted
769  * @p: The task to affect
770  * @policy: The policy to effect
771  * @lp: The parameters to the scheduling policy
772  *
773  * Detemine if the requested scheduler policy change is permitted for the
774  * specified task, returning 0 if permission is granted, -ve if denied.
775  */
776 int cap_task_setscheduler(struct task_struct *p, int policy,
777 			   struct sched_param *lp)
778 {
779 	return cap_safe_nice(p);
780 }
781 
782 /**
783  * cap_task_ioprio - Detemine if I/O priority change is permitted
784  * @p: The task to affect
785  * @ioprio: The I/O priority to set
786  *
787  * Detemine if the requested I/O priority change is permitted for the specified
788  * task, returning 0 if permission is granted, -ve if denied.
789  */
790 int cap_task_setioprio(struct task_struct *p, int ioprio)
791 {
792 	return cap_safe_nice(p);
793 }
794 
795 /**
796  * cap_task_ioprio - Detemine if task priority change is permitted
797  * @p: The task to affect
798  * @nice: The nice value to set
799  *
800  * Detemine if the requested task priority change is permitted for the
801  * specified task, returning 0 if permission is granted, -ve if denied.
802  */
803 int cap_task_setnice(struct task_struct *p, int nice)
804 {
805 	return cap_safe_nice(p);
806 }
807 
808 /*
809  * Implement PR_CAPBSET_DROP.  Attempt to remove the specified capability from
810  * the current task's bounding set.  Returns 0 on success, -ve on error.
811  */
812 static long cap_prctl_drop(struct cred *new, unsigned long cap)
813 {
814 	if (!capable(CAP_SETPCAP))
815 		return -EPERM;
816 	if (!cap_valid(cap))
817 		return -EINVAL;
818 
819 	cap_lower(new->cap_bset, cap);
820 	return 0;
821 }
822 
823 #else
824 int cap_task_setscheduler (struct task_struct *p, int policy,
825 			   struct sched_param *lp)
826 {
827 	return 0;
828 }
829 int cap_task_setioprio (struct task_struct *p, int ioprio)
830 {
831 	return 0;
832 }
833 int cap_task_setnice (struct task_struct *p, int nice)
834 {
835 	return 0;
836 }
837 #endif
838 
839 /**
840  * cap_task_prctl - Implement process control functions for this security module
841  * @option: The process control function requested
842  * @arg2, @arg3, @arg4, @arg5: The argument data for this function
843  *
844  * Allow process control functions (sys_prctl()) to alter capabilities; may
845  * also deny access to other functions not otherwise implemented here.
846  *
847  * Returns 0 or +ve on success, -ENOSYS if this function is not implemented
848  * here, other -ve on error.  If -ENOSYS is returned, sys_prctl() and other LSM
849  * modules will consider performing the function.
850  */
851 int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
852 		   unsigned long arg4, unsigned long arg5)
853 {
854 	struct cred *new;
855 	long error = 0;
856 
857 	new = prepare_creds();
858 	if (!new)
859 		return -ENOMEM;
860 
861 	switch (option) {
862 	case PR_CAPBSET_READ:
863 		error = -EINVAL;
864 		if (!cap_valid(arg2))
865 			goto error;
866 		error = !!cap_raised(new->cap_bset, arg2);
867 		goto no_change;
868 
869 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
870 	case PR_CAPBSET_DROP:
871 		error = cap_prctl_drop(new, arg2);
872 		if (error < 0)
873 			goto error;
874 		goto changed;
875 
876 	/*
877 	 * The next four prctl's remain to assist with transitioning a
878 	 * system from legacy UID=0 based privilege (when filesystem
879 	 * capabilities are not in use) to a system using filesystem
880 	 * capabilities only - as the POSIX.1e draft intended.
881 	 *
882 	 * Note:
883 	 *
884 	 *  PR_SET_SECUREBITS =
885 	 *      issecure_mask(SECURE_KEEP_CAPS_LOCKED)
886 	 *    | issecure_mask(SECURE_NOROOT)
887 	 *    | issecure_mask(SECURE_NOROOT_LOCKED)
888 	 *    | issecure_mask(SECURE_NO_SETUID_FIXUP)
889 	 *    | issecure_mask(SECURE_NO_SETUID_FIXUP_LOCKED)
890 	 *
891 	 * will ensure that the current process and all of its
892 	 * children will be locked into a pure
893 	 * capability-based-privilege environment.
894 	 */
895 	case PR_SET_SECUREBITS:
896 		error = -EPERM;
897 		if ((((new->securebits & SECURE_ALL_LOCKS) >> 1)
898 		     & (new->securebits ^ arg2))			/*[1]*/
899 		    || ((new->securebits & SECURE_ALL_LOCKS & ~arg2))	/*[2]*/
900 		    || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS))	/*[3]*/
901 		    || (cap_capable(current, current_cred(), CAP_SETPCAP,
902 				    SECURITY_CAP_AUDIT) != 0)		/*[4]*/
903 			/*
904 			 * [1] no changing of bits that are locked
905 			 * [2] no unlocking of locks
906 			 * [3] no setting of unsupported bits
907 			 * [4] doing anything requires privilege (go read about
908 			 *     the "sendmail capabilities bug")
909 			 */
910 		    )
911 			/* cannot change a locked bit */
912 			goto error;
913 		new->securebits = arg2;
914 		goto changed;
915 
916 	case PR_GET_SECUREBITS:
917 		error = new->securebits;
918 		goto no_change;
919 
920 #endif /* def CONFIG_SECURITY_FILE_CAPABILITIES */
921 
922 	case PR_GET_KEEPCAPS:
923 		if (issecure(SECURE_KEEP_CAPS))
924 			error = 1;
925 		goto no_change;
926 
927 	case PR_SET_KEEPCAPS:
928 		error = -EINVAL;
929 		if (arg2 > 1) /* Note, we rely on arg2 being unsigned here */
930 			goto error;
931 		error = -EPERM;
932 		if (issecure(SECURE_KEEP_CAPS_LOCKED))
933 			goto error;
934 		if (arg2)
935 			new->securebits |= issecure_mask(SECURE_KEEP_CAPS);
936 		else
937 			new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
938 		goto changed;
939 
940 	default:
941 		/* No functionality available - continue with default */
942 		error = -ENOSYS;
943 		goto error;
944 	}
945 
946 	/* Functionality provided */
947 changed:
948 	return commit_creds(new);
949 
950 no_change:
951 error:
952 	abort_creds(new);
953 	return error;
954 }
955 
956 /**
957  * cap_syslog - Determine whether syslog function is permitted
958  * @type: Function requested
959  *
960  * Determine whether the current process is permitted to use a particular
961  * syslog function, returning 0 if permission is granted, -ve if not.
962  */
963 int cap_syslog(int type)
964 {
965 	if ((type != 3 && type != 10) && !capable(CAP_SYS_ADMIN))
966 		return -EPERM;
967 	return 0;
968 }
969 
970 /**
971  * cap_vm_enough_memory - Determine whether a new virtual mapping is permitted
972  * @mm: The VM space in which the new mapping is to be made
973  * @pages: The size of the mapping
974  *
975  * Determine whether the allocation of a new virtual mapping by the current
976  * task is permitted, returning 0 if permission is granted, -ve if not.
977  */
978 int cap_vm_enough_memory(struct mm_struct *mm, long pages)
979 {
980 	int cap_sys_admin = 0;
981 
982 	if (cap_capable(current, current_cred(), CAP_SYS_ADMIN,
983 			SECURITY_CAP_NOAUDIT) == 0)
984 		cap_sys_admin = 1;
985 	return __vm_enough_memory(mm, pages, cap_sys_admin);
986 }
987 
988 /*
989  * cap_file_mmap - check if able to map given addr
990  * @file: unused
991  * @reqprot: unused
992  * @prot: unused
993  * @flags: unused
994  * @addr: address attempting to be mapped
995  * @addr_only: unused
996  *
997  * If the process is attempting to map memory below mmap_min_addr they need
998  * CAP_SYS_RAWIO.  The other parameters to this function are unused by the
999  * capability security module.  Returns 0 if this mapping should be allowed
1000  * -EPERM if not.
1001  */
1002 int cap_file_mmap(struct file *file, unsigned long reqprot,
1003 		  unsigned long prot, unsigned long flags,
1004 		  unsigned long addr, unsigned long addr_only)
1005 {
1006 	int ret = 0;
1007 
1008 	if (addr < dac_mmap_min_addr) {
1009 		ret = cap_capable(current, current_cred(), CAP_SYS_RAWIO,
1010 				  SECURITY_CAP_AUDIT);
1011 		/* set PF_SUPERPRIV if it turns out we allow the low mmap */
1012 		if (ret == 0)
1013 			current->flags |= PF_SUPERPRIV;
1014 	}
1015 	return ret;
1016 }
1017