Loading...
1/* Common capabilities, needed by capability.o.
2 *
3 * This program is free software; you can redistribute it and/or modify
4 * it under the terms of the GNU General Public License as published by
5 * the Free Software Foundation; either version 2 of the License, or
6 * (at your option) any later version.
7 *
8 */
9
10#include <linux/capability.h>
11#include <linux/audit.h>
12#include <linux/module.h>
13#include <linux/init.h>
14#include <linux/kernel.h>
15#include <linux/lsm_hooks.h>
16#include <linux/file.h>
17#include <linux/mm.h>
18#include <linux/mman.h>
19#include <linux/pagemap.h>
20#include <linux/swap.h>
21#include <linux/skbuff.h>
22#include <linux/netlink.h>
23#include <linux/ptrace.h>
24#include <linux/xattr.h>
25#include <linux/hugetlb.h>
26#include <linux/mount.h>
27#include <linux/sched.h>
28#include <linux/prctl.h>
29#include <linux/securebits.h>
30#include <linux/user_namespace.h>
31#include <linux/binfmts.h>
32#include <linux/personality.h>
33
34/*
35 * If a non-root user executes a setuid-root binary in
36 * !secure(SECURE_NOROOT) mode, then we raise capabilities.
37 * However if fE is also set, then the intent is for only
38 * the file capabilities to be applied, and the setuid-root
39 * bit is left on either to change the uid (plausible) or
40 * to get full privilege on a kernel without file capabilities
41 * support. So in that case we do not raise capabilities.
42 *
43 * Warn if that happens, once per boot.
44 */
45static void warn_setuid_and_fcaps_mixed(const char *fname)
46{
47 static int warned;
48 if (!warned) {
49 printk(KERN_INFO "warning: `%s' has both setuid-root and"
50 " effective capabilities. Therefore not raising all"
51 " capabilities.\n", fname);
52 warned = 1;
53 }
54}
55
56/**
57 * cap_capable - Determine whether a task has a particular effective capability
58 * @cred: The credentials to use
59 * @ns: The user namespace in which we need the capability
60 * @cap: The capability to check for
61 * @audit: Whether to write an audit message or not
62 *
63 * Determine whether the nominated task has the specified capability amongst
64 * its effective set, returning 0 if it does, -ve if it does not.
65 *
66 * NOTE WELL: cap_has_capability() cannot be used like the kernel's capable()
67 * and has_capability() functions. That is, it has the reverse semantics:
68 * cap_has_capability() returns 0 when a task has a capability, but the
69 * kernel's capable() and has_capability() returns 1 for this case.
70 */
71int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
72 int cap, int audit)
73{
74 struct user_namespace *ns = targ_ns;
75
76 /* See if cred has the capability in the target user namespace
77 * by examining the target user namespace and all of the target
78 * user namespace's parents.
79 */
80 for (;;) {
81 /* Do we have the necessary capabilities? */
82 if (ns == cred->user_ns)
83 return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
84
85 /* Have we tried all of the parent namespaces? */
86 if (ns == &init_user_ns)
87 return -EPERM;
88
89 /*
90 * The owner of the user namespace in the parent of the
91 * user namespace has all caps.
92 */
93 if ((ns->parent == cred->user_ns) && uid_eq(ns->owner, cred->euid))
94 return 0;
95
96 /*
97 * If you have a capability in a parent user ns, then you have
98 * it over all children user namespaces as well.
99 */
100 ns = ns->parent;
101 }
102
103 /* We never get here */
104}
105
106/**
107 * cap_settime - Determine whether the current process may set the system clock
108 * @ts: The time to set
109 * @tz: The timezone to set
110 *
111 * Determine whether the current process may set the system clock and timezone
112 * information, returning 0 if permission granted, -ve if denied.
113 */
114int cap_settime(const struct timespec *ts, const struct timezone *tz)
115{
116 if (!capable(CAP_SYS_TIME))
117 return -EPERM;
118 return 0;
119}
120
121/**
122 * cap_ptrace_access_check - Determine whether the current process may access
123 * another
124 * @child: The process to be accessed
125 * @mode: The mode of attachment.
126 *
127 * If we are in the same or an ancestor user_ns and have all the target
128 * task's capabilities, then ptrace access is allowed.
129 * If we have the ptrace capability to the target user_ns, then ptrace
130 * access is allowed.
131 * Else denied.
132 *
133 * Determine whether a process may access another, returning 0 if permission
134 * granted, -ve if denied.
135 */
136int cap_ptrace_access_check(struct task_struct *child, unsigned int mode)
137{
138 int ret = 0;
139 const struct cred *cred, *child_cred;
140 const kernel_cap_t *caller_caps;
141
142 rcu_read_lock();
143 cred = current_cred();
144 child_cred = __task_cred(child);
145 if (mode & PTRACE_MODE_FSCREDS)
146 caller_caps = &cred->cap_effective;
147 else
148 caller_caps = &cred->cap_permitted;
149 if (cred->user_ns == child_cred->user_ns &&
150 cap_issubset(child_cred->cap_permitted, *caller_caps))
151 goto out;
152 if (ns_capable(child_cred->user_ns, CAP_SYS_PTRACE))
153 goto out;
154 ret = -EPERM;
155out:
156 rcu_read_unlock();
157 return ret;
158}
159
160/**
161 * cap_ptrace_traceme - Determine whether another process may trace the current
162 * @parent: The task proposed to be the tracer
163 *
164 * If parent is in the same or an ancestor user_ns and has all current's
165 * capabilities, then ptrace access is allowed.
166 * If parent has the ptrace capability to current's user_ns, then ptrace
167 * access is allowed.
168 * Else denied.
169 *
170 * Determine whether the nominated task is permitted to trace the current
171 * process, returning 0 if permission is granted, -ve if denied.
172 */
173int cap_ptrace_traceme(struct task_struct *parent)
174{
175 int ret = 0;
176 const struct cred *cred, *child_cred;
177
178 rcu_read_lock();
179 cred = __task_cred(parent);
180 child_cred = current_cred();
181 if (cred->user_ns == child_cred->user_ns &&
182 cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
183 goto out;
184 if (has_ns_capability(parent, child_cred->user_ns, CAP_SYS_PTRACE))
185 goto out;
186 ret = -EPERM;
187out:
188 rcu_read_unlock();
189 return ret;
190}
191
192/**
193 * cap_capget - Retrieve a task's capability sets
194 * @target: The task from which to retrieve the capability sets
195 * @effective: The place to record the effective set
196 * @inheritable: The place to record the inheritable set
197 * @permitted: The place to record the permitted set
198 *
199 * This function retrieves the capabilities of the nominated task and returns
200 * them to the caller.
201 */
202int cap_capget(struct task_struct *target, kernel_cap_t *effective,
203 kernel_cap_t *inheritable, kernel_cap_t *permitted)
204{
205 const struct cred *cred;
206
207 /* Derived from kernel/capability.c:sys_capget. */
208 rcu_read_lock();
209 cred = __task_cred(target);
210 *effective = cred->cap_effective;
211 *inheritable = cred->cap_inheritable;
212 *permitted = cred->cap_permitted;
213 rcu_read_unlock();
214 return 0;
215}
216
217/*
218 * Determine whether the inheritable capabilities are limited to the old
219 * permitted set. Returns 1 if they are limited, 0 if they are not.
220 */
221static inline int cap_inh_is_capped(void)
222{
223
224 /* they are so limited unless the current task has the CAP_SETPCAP
225 * capability
226 */
227 if (cap_capable(current_cred(), current_cred()->user_ns,
228 CAP_SETPCAP, SECURITY_CAP_AUDIT) == 0)
229 return 0;
230 return 1;
231}
232
233/**
234 * cap_capset - Validate and apply proposed changes to current's capabilities
235 * @new: The proposed new credentials; alterations should be made here
236 * @old: The current task's current credentials
237 * @effective: A pointer to the proposed new effective capabilities set
238 * @inheritable: A pointer to the proposed new inheritable capabilities set
239 * @permitted: A pointer to the proposed new permitted capabilities set
240 *
241 * This function validates and applies a proposed mass change to the current
242 * process's capability sets. The changes are made to the proposed new
243 * credentials, and assuming no error, will be committed by the caller of LSM.
244 */
245int cap_capset(struct cred *new,
246 const struct cred *old,
247 const kernel_cap_t *effective,
248 const kernel_cap_t *inheritable,
249 const kernel_cap_t *permitted)
250{
251 if (cap_inh_is_capped() &&
252 !cap_issubset(*inheritable,
253 cap_combine(old->cap_inheritable,
254 old->cap_permitted)))
255 /* incapable of using this inheritable set */
256 return -EPERM;
257
258 if (!cap_issubset(*inheritable,
259 cap_combine(old->cap_inheritable,
260 old->cap_bset)))
261 /* no new pI capabilities outside bounding set */
262 return -EPERM;
263
264 /* verify restrictions on target's new Permitted set */
265 if (!cap_issubset(*permitted, old->cap_permitted))
266 return -EPERM;
267
268 /* verify the _new_Effective_ is a subset of the _new_Permitted_ */
269 if (!cap_issubset(*effective, *permitted))
270 return -EPERM;
271
272 new->cap_effective = *effective;
273 new->cap_inheritable = *inheritable;
274 new->cap_permitted = *permitted;
275
276 /*
277 * Mask off ambient bits that are no longer both permitted and
278 * inheritable.
279 */
280 new->cap_ambient = cap_intersect(new->cap_ambient,
281 cap_intersect(*permitted,
282 *inheritable));
283 if (WARN_ON(!cap_ambient_invariant_ok(new)))
284 return -EINVAL;
285 return 0;
286}
287
288/*
289 * Clear proposed capability sets for execve().
290 */
291static inline void bprm_clear_caps(struct linux_binprm *bprm)
292{
293 cap_clear(bprm->cred->cap_permitted);
294 bprm->cap_effective = false;
295}
296
297/**
298 * cap_inode_need_killpriv - Determine if inode change affects privileges
299 * @dentry: The inode/dentry in being changed with change marked ATTR_KILL_PRIV
300 *
301 * Determine if an inode having a change applied that's marked ATTR_KILL_PRIV
302 * affects the security markings on that inode, and if it is, should
303 * inode_killpriv() be invoked or the change rejected?
304 *
305 * Returns 0 if granted; +ve if granted, but inode_killpriv() is required; and
306 * -ve to deny the change.
307 */
308int cap_inode_need_killpriv(struct dentry *dentry)
309{
310 struct inode *inode = d_backing_inode(dentry);
311 int error;
312
313 if (!inode->i_op->getxattr)
314 return 0;
315
316 error = inode->i_op->getxattr(dentry, XATTR_NAME_CAPS, NULL, 0);
317 if (error <= 0)
318 return 0;
319 return 1;
320}
321
322/**
323 * cap_inode_killpriv - Erase the security markings on an inode
324 * @dentry: The inode/dentry to alter
325 *
326 * Erase the privilege-enhancing security markings on an inode.
327 *
328 * Returns 0 if successful, -ve on error.
329 */
330int cap_inode_killpriv(struct dentry *dentry)
331{
332 struct inode *inode = d_backing_inode(dentry);
333
334 if (!inode->i_op->removexattr)
335 return 0;
336
337 return inode->i_op->removexattr(dentry, XATTR_NAME_CAPS);
338}
339
340/*
341 * Calculate the new process capability sets from the capability sets attached
342 * to a file.
343 */
344static inline int bprm_caps_from_vfs_caps(struct cpu_vfs_cap_data *caps,
345 struct linux_binprm *bprm,
346 bool *effective,
347 bool *has_cap)
348{
349 struct cred *new = bprm->cred;
350 unsigned i;
351 int ret = 0;
352
353 if (caps->magic_etc & VFS_CAP_FLAGS_EFFECTIVE)
354 *effective = true;
355
356 if (caps->magic_etc & VFS_CAP_REVISION_MASK)
357 *has_cap = true;
358
359 CAP_FOR_EACH_U32(i) {
360 __u32 permitted = caps->permitted.cap[i];
361 __u32 inheritable = caps->inheritable.cap[i];
362
363 /*
364 * pP' = (X & fP) | (pI & fI)
365 * The addition of pA' is handled later.
366 */
367 new->cap_permitted.cap[i] =
368 (new->cap_bset.cap[i] & permitted) |
369 (new->cap_inheritable.cap[i] & inheritable);
370
371 if (permitted & ~new->cap_permitted.cap[i])
372 /* insufficient to execute correctly */
373 ret = -EPERM;
374 }
375
376 /*
377 * For legacy apps, with no internal support for recognizing they
378 * do not have enough capabilities, we return an error if they are
379 * missing some "forced" (aka file-permitted) capabilities.
380 */
381 return *effective ? ret : 0;
382}
383
384/*
385 * Extract the on-exec-apply capability sets for an executable file.
386 */
387int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps)
388{
389 struct inode *inode = d_backing_inode(dentry);
390 __u32 magic_etc;
391 unsigned tocopy, i;
392 int size;
393 struct vfs_cap_data caps;
394
395 memset(cpu_caps, 0, sizeof(struct cpu_vfs_cap_data));
396
397 if (!inode || !inode->i_op->getxattr)
398 return -ENODATA;
399
400 size = inode->i_op->getxattr((struct dentry *)dentry, XATTR_NAME_CAPS, &caps,
401 XATTR_CAPS_SZ);
402 if (size == -ENODATA || size == -EOPNOTSUPP)
403 /* no data, that's ok */
404 return -ENODATA;
405 if (size < 0)
406 return size;
407
408 if (size < sizeof(magic_etc))
409 return -EINVAL;
410
411 cpu_caps->magic_etc = magic_etc = le32_to_cpu(caps.magic_etc);
412
413 switch (magic_etc & VFS_CAP_REVISION_MASK) {
414 case VFS_CAP_REVISION_1:
415 if (size != XATTR_CAPS_SZ_1)
416 return -EINVAL;
417 tocopy = VFS_CAP_U32_1;
418 break;
419 case VFS_CAP_REVISION_2:
420 if (size != XATTR_CAPS_SZ_2)
421 return -EINVAL;
422 tocopy = VFS_CAP_U32_2;
423 break;
424 default:
425 return -EINVAL;
426 }
427
428 CAP_FOR_EACH_U32(i) {
429 if (i >= tocopy)
430 break;
431 cpu_caps->permitted.cap[i] = le32_to_cpu(caps.data[i].permitted);
432 cpu_caps->inheritable.cap[i] = le32_to_cpu(caps.data[i].inheritable);
433 }
434
435 cpu_caps->permitted.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
436 cpu_caps->inheritable.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
437
438 return 0;
439}
440
441/*
442 * Attempt to get the on-exec apply capability sets for an executable file from
443 * its xattrs and, if present, apply them to the proposed credentials being
444 * constructed by execve().
445 */
446static int get_file_caps(struct linux_binprm *bprm, bool *effective, bool *has_cap)
447{
448 int rc = 0;
449 struct cpu_vfs_cap_data vcaps;
450
451 bprm_clear_caps(bprm);
452
453 if (!file_caps_enabled)
454 return 0;
455
456 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
457 return 0;
458
459 rc = get_vfs_caps_from_disk(bprm->file->f_path.dentry, &vcaps);
460 if (rc < 0) {
461 if (rc == -EINVAL)
462 printk(KERN_NOTICE "%s: get_vfs_caps_from_disk returned %d for %s\n",
463 __func__, rc, bprm->filename);
464 else if (rc == -ENODATA)
465 rc = 0;
466 goto out;
467 }
468
469 rc = bprm_caps_from_vfs_caps(&vcaps, bprm, effective, has_cap);
470 if (rc == -EINVAL)
471 printk(KERN_NOTICE "%s: cap_from_disk returned %d for %s\n",
472 __func__, rc, bprm->filename);
473
474out:
475 if (rc)
476 bprm_clear_caps(bprm);
477
478 return rc;
479}
480
481/**
482 * cap_bprm_set_creds - Set up the proposed credentials for execve().
483 * @bprm: The execution parameters, including the proposed creds
484 *
485 * Set up the proposed credentials for a new execution context being
486 * constructed by execve(). The proposed creds in @bprm->cred is altered,
487 * which won't take effect immediately. Returns 0 if successful, -ve on error.
488 */
489int cap_bprm_set_creds(struct linux_binprm *bprm)
490{
491 const struct cred *old = current_cred();
492 struct cred *new = bprm->cred;
493 bool effective, has_cap = false, is_setid;
494 int ret;
495 kuid_t root_uid;
496
497 if (WARN_ON(!cap_ambient_invariant_ok(old)))
498 return -EPERM;
499
500 effective = false;
501 ret = get_file_caps(bprm, &effective, &has_cap);
502 if (ret < 0)
503 return ret;
504
505 root_uid = make_kuid(new->user_ns, 0);
506
507 if (!issecure(SECURE_NOROOT)) {
508 /*
509 * If the legacy file capability is set, then don't set privs
510 * for a setuid root binary run by a non-root user. Do set it
511 * for a root user just to cause least surprise to an admin.
512 */
513 if (has_cap && !uid_eq(new->uid, root_uid) && uid_eq(new->euid, root_uid)) {
514 warn_setuid_and_fcaps_mixed(bprm->filename);
515 goto skip;
516 }
517 /*
518 * To support inheritance of root-permissions and suid-root
519 * executables under compatibility mode, we override the
520 * capability sets for the file.
521 *
522 * If only the real uid is 0, we do not set the effective bit.
523 */
524 if (uid_eq(new->euid, root_uid) || uid_eq(new->uid, root_uid)) {
525 /* pP' = (cap_bset & ~0) | (pI & ~0) */
526 new->cap_permitted = cap_combine(old->cap_bset,
527 old->cap_inheritable);
528 }
529 if (uid_eq(new->euid, root_uid))
530 effective = true;
531 }
532skip:
533
534 /* if we have fs caps, clear dangerous personality flags */
535 if (!cap_issubset(new->cap_permitted, old->cap_permitted))
536 bprm->per_clear |= PER_CLEAR_ON_SETID;
537
538
539 /* Don't let someone trace a set[ug]id/setpcap binary with the revised
540 * credentials unless they have the appropriate permit.
541 *
542 * In addition, if NO_NEW_PRIVS, then ensure we get no new privs.
543 */
544 is_setid = !uid_eq(new->euid, old->uid) || !gid_eq(new->egid, old->gid);
545
546 if ((is_setid ||
547 !cap_issubset(new->cap_permitted, old->cap_permitted)) &&
548 bprm->unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
549 /* downgrade; they get no more than they had, and maybe less */
550 if (!capable(CAP_SETUID) ||
551 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)) {
552 new->euid = new->uid;
553 new->egid = new->gid;
554 }
555 new->cap_permitted = cap_intersect(new->cap_permitted,
556 old->cap_permitted);
557 }
558
559 new->suid = new->fsuid = new->euid;
560 new->sgid = new->fsgid = new->egid;
561
562 /* File caps or setid cancels ambient. */
563 if (has_cap || is_setid)
564 cap_clear(new->cap_ambient);
565
566 /*
567 * Now that we've computed pA', update pP' to give:
568 * pP' = (X & fP) | (pI & fI) | pA'
569 */
570 new->cap_permitted = cap_combine(new->cap_permitted, new->cap_ambient);
571
572 /*
573 * Set pE' = (fE ? pP' : pA'). Because pA' is zero if fE is set,
574 * this is the same as pE' = (fE ? pP' : 0) | pA'.
575 */
576 if (effective)
577 new->cap_effective = new->cap_permitted;
578 else
579 new->cap_effective = new->cap_ambient;
580
581 if (WARN_ON(!cap_ambient_invariant_ok(new)))
582 return -EPERM;
583
584 bprm->cap_effective = effective;
585
586 /*
587 * Audit candidate if current->cap_effective is set
588 *
589 * We do not bother to audit if 3 things are true:
590 * 1) cap_effective has all caps
591 * 2) we are root
592 * 3) root is supposed to have all caps (SECURE_NOROOT)
593 * Since this is just a normal root execing a process.
594 *
595 * Number 1 above might fail if you don't have a full bset, but I think
596 * that is interesting information to audit.
597 */
598 if (!cap_issubset(new->cap_effective, new->cap_ambient)) {
599 if (!cap_issubset(CAP_FULL_SET, new->cap_effective) ||
600 !uid_eq(new->euid, root_uid) || !uid_eq(new->uid, root_uid) ||
601 issecure(SECURE_NOROOT)) {
602 ret = audit_log_bprm_fcaps(bprm, new, old);
603 if (ret < 0)
604 return ret;
605 }
606 }
607
608 new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
609
610 if (WARN_ON(!cap_ambient_invariant_ok(new)))
611 return -EPERM;
612
613 return 0;
614}
615
616/**
617 * cap_bprm_secureexec - Determine whether a secure execution is required
618 * @bprm: The execution parameters
619 *
620 * Determine whether a secure execution is required, return 1 if it is, and 0
621 * if it is not.
622 *
623 * The credentials have been committed by this point, and so are no longer
624 * available through @bprm->cred.
625 */
626int cap_bprm_secureexec(struct linux_binprm *bprm)
627{
628 const struct cred *cred = current_cred();
629 kuid_t root_uid = make_kuid(cred->user_ns, 0);
630
631 if (!uid_eq(cred->uid, root_uid)) {
632 if (bprm->cap_effective)
633 return 1;
634 if (!cap_issubset(cred->cap_permitted, cred->cap_ambient))
635 return 1;
636 }
637
638 return (!uid_eq(cred->euid, cred->uid) ||
639 !gid_eq(cred->egid, cred->gid));
640}
641
642/**
643 * cap_inode_setxattr - Determine whether an xattr may be altered
644 * @dentry: The inode/dentry being altered
645 * @name: The name of the xattr to be changed
646 * @value: The value that the xattr will be changed to
647 * @size: The size of value
648 * @flags: The replacement flag
649 *
650 * Determine whether an xattr may be altered or set on an inode, returning 0 if
651 * permission is granted, -ve if denied.
652 *
653 * This is used to make sure security xattrs don't get updated or set by those
654 * who aren't privileged to do so.
655 */
656int cap_inode_setxattr(struct dentry *dentry, const char *name,
657 const void *value, size_t size, int flags)
658{
659 if (!strcmp(name, XATTR_NAME_CAPS)) {
660 if (!capable(CAP_SETFCAP))
661 return -EPERM;
662 return 0;
663 }
664
665 if (!strncmp(name, XATTR_SECURITY_PREFIX,
666 sizeof(XATTR_SECURITY_PREFIX) - 1) &&
667 !capable(CAP_SYS_ADMIN))
668 return -EPERM;
669 return 0;
670}
671
672/**
673 * cap_inode_removexattr - Determine whether an xattr may be removed
674 * @dentry: The inode/dentry being altered
675 * @name: The name of the xattr to be changed
676 *
677 * Determine whether an xattr may be removed from an inode, returning 0 if
678 * permission is granted, -ve if denied.
679 *
680 * This is used to make sure security xattrs don't get removed by those who
681 * aren't privileged to remove them.
682 */
683int cap_inode_removexattr(struct dentry *dentry, const char *name)
684{
685 if (!strcmp(name, XATTR_NAME_CAPS)) {
686 if (!capable(CAP_SETFCAP))
687 return -EPERM;
688 return 0;
689 }
690
691 if (!strncmp(name, XATTR_SECURITY_PREFIX,
692 sizeof(XATTR_SECURITY_PREFIX) - 1) &&
693 !capable(CAP_SYS_ADMIN))
694 return -EPERM;
695 return 0;
696}
697
698/*
699 * cap_emulate_setxuid() fixes the effective / permitted capabilities of
700 * a process after a call to setuid, setreuid, or setresuid.
701 *
702 * 1) When set*uiding _from_ one of {r,e,s}uid == 0 _to_ all of
703 * {r,e,s}uid != 0, the permitted and effective capabilities are
704 * cleared.
705 *
706 * 2) When set*uiding _from_ euid == 0 _to_ euid != 0, the effective
707 * capabilities of the process are cleared.
708 *
709 * 3) When set*uiding _from_ euid != 0 _to_ euid == 0, the effective
710 * capabilities are set to the permitted capabilities.
711 *
712 * fsuid is handled elsewhere. fsuid == 0 and {r,e,s}uid!= 0 should
713 * never happen.
714 *
715 * -astor
716 *
717 * cevans - New behaviour, Oct '99
718 * A process may, via prctl(), elect to keep its capabilities when it
719 * calls setuid() and switches away from uid==0. Both permitted and
720 * effective sets will be retained.
721 * Without this change, it was impossible for a daemon to drop only some
722 * of its privilege. The call to setuid(!=0) would drop all privileges!
723 * Keeping uid 0 is not an option because uid 0 owns too many vital
724 * files..
725 * Thanks to Olaf Kirch and Peter Benie for spotting this.
726 */
727static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)
728{
729 kuid_t root_uid = make_kuid(old->user_ns, 0);
730
731 if ((uid_eq(old->uid, root_uid) ||
732 uid_eq(old->euid, root_uid) ||
733 uid_eq(old->suid, root_uid)) &&
734 (!uid_eq(new->uid, root_uid) &&
735 !uid_eq(new->euid, root_uid) &&
736 !uid_eq(new->suid, root_uid))) {
737 if (!issecure(SECURE_KEEP_CAPS)) {
738 cap_clear(new->cap_permitted);
739 cap_clear(new->cap_effective);
740 }
741
742 /*
743 * Pre-ambient programs expect setresuid to nonroot followed
744 * by exec to drop capabilities. We should make sure that
745 * this remains the case.
746 */
747 cap_clear(new->cap_ambient);
748 }
749 if (uid_eq(old->euid, root_uid) && !uid_eq(new->euid, root_uid))
750 cap_clear(new->cap_effective);
751 if (!uid_eq(old->euid, root_uid) && uid_eq(new->euid, root_uid))
752 new->cap_effective = new->cap_permitted;
753}
754
755/**
756 * cap_task_fix_setuid - Fix up the results of setuid() call
757 * @new: The proposed credentials
758 * @old: The current task's current credentials
759 * @flags: Indications of what has changed
760 *
761 * Fix up the results of setuid() call before the credential changes are
762 * actually applied, returning 0 to grant the changes, -ve to deny them.
763 */
764int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
765{
766 switch (flags) {
767 case LSM_SETID_RE:
768 case LSM_SETID_ID:
769 case LSM_SETID_RES:
770 /* juggle the capabilities to follow [RES]UID changes unless
771 * otherwise suppressed */
772 if (!issecure(SECURE_NO_SETUID_FIXUP))
773 cap_emulate_setxuid(new, old);
774 break;
775
776 case LSM_SETID_FS:
777 /* juggle the capabilties to follow FSUID changes, unless
778 * otherwise suppressed
779 *
780 * FIXME - is fsuser used for all CAP_FS_MASK capabilities?
781 * if not, we might be a bit too harsh here.
782 */
783 if (!issecure(SECURE_NO_SETUID_FIXUP)) {
784 kuid_t root_uid = make_kuid(old->user_ns, 0);
785 if (uid_eq(old->fsuid, root_uid) && !uid_eq(new->fsuid, root_uid))
786 new->cap_effective =
787 cap_drop_fs_set(new->cap_effective);
788
789 if (!uid_eq(old->fsuid, root_uid) && uid_eq(new->fsuid, root_uid))
790 new->cap_effective =
791 cap_raise_fs_set(new->cap_effective,
792 new->cap_permitted);
793 }
794 break;
795
796 default:
797 return -EINVAL;
798 }
799
800 return 0;
801}
802
803/*
804 * Rationale: code calling task_setscheduler, task_setioprio, and
805 * task_setnice, assumes that
806 * . if capable(cap_sys_nice), then those actions should be allowed
807 * . if not capable(cap_sys_nice), but acting on your own processes,
808 * then those actions should be allowed
809 * This is insufficient now since you can call code without suid, but
810 * yet with increased caps.
811 * So we check for increased caps on the target process.
812 */
813static int cap_safe_nice(struct task_struct *p)
814{
815 int is_subset, ret = 0;
816
817 rcu_read_lock();
818 is_subset = cap_issubset(__task_cred(p)->cap_permitted,
819 current_cred()->cap_permitted);
820 if (!is_subset && !ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE))
821 ret = -EPERM;
822 rcu_read_unlock();
823
824 return ret;
825}
826
827/**
828 * cap_task_setscheduler - Detemine if scheduler policy change is permitted
829 * @p: The task to affect
830 *
831 * Detemine if the requested scheduler policy change is permitted for the
832 * specified task, returning 0 if permission is granted, -ve if denied.
833 */
834int cap_task_setscheduler(struct task_struct *p)
835{
836 return cap_safe_nice(p);
837}
838
839/**
840 * cap_task_ioprio - Detemine if I/O priority change is permitted
841 * @p: The task to affect
842 * @ioprio: The I/O priority to set
843 *
844 * Detemine if the requested I/O priority change is permitted for the specified
845 * task, returning 0 if permission is granted, -ve if denied.
846 */
847int cap_task_setioprio(struct task_struct *p, int ioprio)
848{
849 return cap_safe_nice(p);
850}
851
852/**
853 * cap_task_ioprio - Detemine if task priority change is permitted
854 * @p: The task to affect
855 * @nice: The nice value to set
856 *
857 * Detemine if the requested task priority change is permitted for the
858 * specified task, returning 0 if permission is granted, -ve if denied.
859 */
860int cap_task_setnice(struct task_struct *p, int nice)
861{
862 return cap_safe_nice(p);
863}
864
865/*
866 * Implement PR_CAPBSET_DROP. Attempt to remove the specified capability from
867 * the current task's bounding set. Returns 0 on success, -ve on error.
868 */
869static int cap_prctl_drop(unsigned long cap)
870{
871 struct cred *new;
872
873 if (!ns_capable(current_user_ns(), CAP_SETPCAP))
874 return -EPERM;
875 if (!cap_valid(cap))
876 return -EINVAL;
877
878 new = prepare_creds();
879 if (!new)
880 return -ENOMEM;
881 cap_lower(new->cap_bset, cap);
882 return commit_creds(new);
883}
884
885/**
886 * cap_task_prctl - Implement process control functions for this security module
887 * @option: The process control function requested
888 * @arg2, @arg3, @arg4, @arg5: The argument data for this function
889 *
890 * Allow process control functions (sys_prctl()) to alter capabilities; may
891 * also deny access to other functions not otherwise implemented here.
892 *
893 * Returns 0 or +ve on success, -ENOSYS if this function is not implemented
894 * here, other -ve on error. If -ENOSYS is returned, sys_prctl() and other LSM
895 * modules will consider performing the function.
896 */
897int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
898 unsigned long arg4, unsigned long arg5)
899{
900 const struct cred *old = current_cred();
901 struct cred *new;
902
903 switch (option) {
904 case PR_CAPBSET_READ:
905 if (!cap_valid(arg2))
906 return -EINVAL;
907 return !!cap_raised(old->cap_bset, arg2);
908
909 case PR_CAPBSET_DROP:
910 return cap_prctl_drop(arg2);
911
912 /*
913 * The next four prctl's remain to assist with transitioning a
914 * system from legacy UID=0 based privilege (when filesystem
915 * capabilities are not in use) to a system using filesystem
916 * capabilities only - as the POSIX.1e draft intended.
917 *
918 * Note:
919 *
920 * PR_SET_SECUREBITS =
921 * issecure_mask(SECURE_KEEP_CAPS_LOCKED)
922 * | issecure_mask(SECURE_NOROOT)
923 * | issecure_mask(SECURE_NOROOT_LOCKED)
924 * | issecure_mask(SECURE_NO_SETUID_FIXUP)
925 * | issecure_mask(SECURE_NO_SETUID_FIXUP_LOCKED)
926 *
927 * will ensure that the current process and all of its
928 * children will be locked into a pure
929 * capability-based-privilege environment.
930 */
931 case PR_SET_SECUREBITS:
932 if ((((old->securebits & SECURE_ALL_LOCKS) >> 1)
933 & (old->securebits ^ arg2)) /*[1]*/
934 || ((old->securebits & SECURE_ALL_LOCKS & ~arg2)) /*[2]*/
935 || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS)) /*[3]*/
936 || (cap_capable(current_cred(),
937 current_cred()->user_ns, CAP_SETPCAP,
938 SECURITY_CAP_AUDIT) != 0) /*[4]*/
939 /*
940 * [1] no changing of bits that are locked
941 * [2] no unlocking of locks
942 * [3] no setting of unsupported bits
943 * [4] doing anything requires privilege (go read about
944 * the "sendmail capabilities bug")
945 */
946 )
947 /* cannot change a locked bit */
948 return -EPERM;
949
950 new = prepare_creds();
951 if (!new)
952 return -ENOMEM;
953 new->securebits = arg2;
954 return commit_creds(new);
955
956 case PR_GET_SECUREBITS:
957 return old->securebits;
958
959 case PR_GET_KEEPCAPS:
960 return !!issecure(SECURE_KEEP_CAPS);
961
962 case PR_SET_KEEPCAPS:
963 if (arg2 > 1) /* Note, we rely on arg2 being unsigned here */
964 return -EINVAL;
965 if (issecure(SECURE_KEEP_CAPS_LOCKED))
966 return -EPERM;
967
968 new = prepare_creds();
969 if (!new)
970 return -ENOMEM;
971 if (arg2)
972 new->securebits |= issecure_mask(SECURE_KEEP_CAPS);
973 else
974 new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
975 return commit_creds(new);
976
977 case PR_CAP_AMBIENT:
978 if (arg2 == PR_CAP_AMBIENT_CLEAR_ALL) {
979 if (arg3 | arg4 | arg5)
980 return -EINVAL;
981
982 new = prepare_creds();
983 if (!new)
984 return -ENOMEM;
985 cap_clear(new->cap_ambient);
986 return commit_creds(new);
987 }
988
989 if (((!cap_valid(arg3)) | arg4 | arg5))
990 return -EINVAL;
991
992 if (arg2 == PR_CAP_AMBIENT_IS_SET) {
993 return !!cap_raised(current_cred()->cap_ambient, arg3);
994 } else if (arg2 != PR_CAP_AMBIENT_RAISE &&
995 arg2 != PR_CAP_AMBIENT_LOWER) {
996 return -EINVAL;
997 } else {
998 if (arg2 == PR_CAP_AMBIENT_RAISE &&
999 (!cap_raised(current_cred()->cap_permitted, arg3) ||
1000 !cap_raised(current_cred()->cap_inheritable,
1001 arg3) ||
1002 issecure(SECURE_NO_CAP_AMBIENT_RAISE)))
1003 return -EPERM;
1004
1005 new = prepare_creds();
1006 if (!new)
1007 return -ENOMEM;
1008 if (arg2 == PR_CAP_AMBIENT_RAISE)
1009 cap_raise(new->cap_ambient, arg3);
1010 else
1011 cap_lower(new->cap_ambient, arg3);
1012 return commit_creds(new);
1013 }
1014
1015 default:
1016 /* No functionality available - continue with default */
1017 return -ENOSYS;
1018 }
1019}
1020
1021/**
1022 * cap_vm_enough_memory - Determine whether a new virtual mapping is permitted
1023 * @mm: The VM space in which the new mapping is to be made
1024 * @pages: The size of the mapping
1025 *
1026 * Determine whether the allocation of a new virtual mapping by the current
1027 * task is permitted, returning 1 if permission is granted, 0 if not.
1028 */
1029int cap_vm_enough_memory(struct mm_struct *mm, long pages)
1030{
1031 int cap_sys_admin = 0;
1032
1033 if (cap_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
1034 SECURITY_CAP_NOAUDIT) == 0)
1035 cap_sys_admin = 1;
1036 return cap_sys_admin;
1037}
1038
1039/*
1040 * cap_mmap_addr - check if able to map given addr
1041 * @addr: address attempting to be mapped
1042 *
1043 * If the process is attempting to map memory below dac_mmap_min_addr they need
1044 * CAP_SYS_RAWIO. The other parameters to this function are unused by the
1045 * capability security module. Returns 0 if this mapping should be allowed
1046 * -EPERM if not.
1047 */
1048int cap_mmap_addr(unsigned long addr)
1049{
1050 int ret = 0;
1051
1052 if (addr < dac_mmap_min_addr) {
1053 ret = cap_capable(current_cred(), &init_user_ns, CAP_SYS_RAWIO,
1054 SECURITY_CAP_AUDIT);
1055 /* set PF_SUPERPRIV if it turns out we allow the low mmap */
1056 if (ret == 0)
1057 current->flags |= PF_SUPERPRIV;
1058 }
1059 return ret;
1060}
1061
1062int cap_mmap_file(struct file *file, unsigned long reqprot,
1063 unsigned long prot, unsigned long flags)
1064{
1065 return 0;
1066}
1067
1068#ifdef CONFIG_SECURITY
1069
1070struct security_hook_list capability_hooks[] = {
1071 LSM_HOOK_INIT(capable, cap_capable),
1072 LSM_HOOK_INIT(settime, cap_settime),
1073 LSM_HOOK_INIT(ptrace_access_check, cap_ptrace_access_check),
1074 LSM_HOOK_INIT(ptrace_traceme, cap_ptrace_traceme),
1075 LSM_HOOK_INIT(capget, cap_capget),
1076 LSM_HOOK_INIT(capset, cap_capset),
1077 LSM_HOOK_INIT(bprm_set_creds, cap_bprm_set_creds),
1078 LSM_HOOK_INIT(bprm_secureexec, cap_bprm_secureexec),
1079 LSM_HOOK_INIT(inode_need_killpriv, cap_inode_need_killpriv),
1080 LSM_HOOK_INIT(inode_killpriv, cap_inode_killpriv),
1081 LSM_HOOK_INIT(mmap_addr, cap_mmap_addr),
1082 LSM_HOOK_INIT(mmap_file, cap_mmap_file),
1083 LSM_HOOK_INIT(task_fix_setuid, cap_task_fix_setuid),
1084 LSM_HOOK_INIT(task_prctl, cap_task_prctl),
1085 LSM_HOOK_INIT(task_setscheduler, cap_task_setscheduler),
1086 LSM_HOOK_INIT(task_setioprio, cap_task_setioprio),
1087 LSM_HOOK_INIT(task_setnice, cap_task_setnice),
1088 LSM_HOOK_INIT(vm_enough_memory, cap_vm_enough_memory),
1089};
1090
1091void __init capability_add_hooks(void)
1092{
1093 security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks));
1094}
1095
1096#endif /* CONFIG_SECURITY */
1// SPDX-License-Identifier: GPL-2.0-or-later
2/* Common capabilities, needed by capability.o.
3 */
4
5#include <linux/capability.h>
6#include <linux/audit.h>
7#include <linux/init.h>
8#include <linux/kernel.h>
9#include <linux/lsm_hooks.h>
10#include <linux/file.h>
11#include <linux/mm.h>
12#include <linux/mman.h>
13#include <linux/pagemap.h>
14#include <linux/swap.h>
15#include <linux/skbuff.h>
16#include <linux/netlink.h>
17#include <linux/ptrace.h>
18#include <linux/xattr.h>
19#include <linux/hugetlb.h>
20#include <linux/mount.h>
21#include <linux/sched.h>
22#include <linux/prctl.h>
23#include <linux/securebits.h>
24#include <linux/user_namespace.h>
25#include <linux/binfmts.h>
26#include <linux/personality.h>
27#include <linux/mnt_idmapping.h>
28#include <uapi/linux/lsm.h>
29
30/*
31 * If a non-root user executes a setuid-root binary in
32 * !secure(SECURE_NOROOT) mode, then we raise capabilities.
33 * However if fE is also set, then the intent is for only
34 * the file capabilities to be applied, and the setuid-root
35 * bit is left on either to change the uid (plausible) or
36 * to get full privilege on a kernel without file capabilities
37 * support. So in that case we do not raise capabilities.
38 *
39 * Warn if that happens, once per boot.
40 */
41static void warn_setuid_and_fcaps_mixed(const char *fname)
42{
43 static int warned;
44 if (!warned) {
45 printk(KERN_INFO "warning: `%s' has both setuid-root and"
46 " effective capabilities. Therefore not raising all"
47 " capabilities.\n", fname);
48 warned = 1;
49 }
50}
51
52/**
53 * cap_capable - Determine whether a task has a particular effective capability
54 * @cred: The credentials to use
55 * @targ_ns: The user namespace in which we need the capability
56 * @cap: The capability to check for
57 * @opts: Bitmask of options defined in include/linux/security.h
58 *
59 * Determine whether the nominated task has the specified capability amongst
60 * its effective set, returning 0 if it does, -ve if it does not.
61 *
62 * NOTE WELL: cap_has_capability() cannot be used like the kernel's capable()
63 * and has_capability() functions. That is, it has the reverse semantics:
64 * cap_has_capability() returns 0 when a task has a capability, but the
65 * kernel's capable() and has_capability() returns 1 for this case.
66 */
67int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
68 int cap, unsigned int opts)
69{
70 struct user_namespace *ns = targ_ns;
71
72 /* See if cred has the capability in the target user namespace
73 * by examining the target user namespace and all of the target
74 * user namespace's parents.
75 */
76 for (;;) {
77 /* Do we have the necessary capabilities? */
78 if (ns == cred->user_ns)
79 return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
80
81 /*
82 * If we're already at a lower level than we're looking for,
83 * we're done searching.
84 */
85 if (ns->level <= cred->user_ns->level)
86 return -EPERM;
87
88 /*
89 * The owner of the user namespace in the parent of the
90 * user namespace has all caps.
91 */
92 if ((ns->parent == cred->user_ns) && uid_eq(ns->owner, cred->euid))
93 return 0;
94
95 /*
96 * If you have a capability in a parent user ns, then you have
97 * it over all children user namespaces as well.
98 */
99 ns = ns->parent;
100 }
101
102 /* We never get here */
103}
104
105/**
106 * cap_settime - Determine whether the current process may set the system clock
107 * @ts: The time to set
108 * @tz: The timezone to set
109 *
110 * Determine whether the current process may set the system clock and timezone
111 * information, returning 0 if permission granted, -ve if denied.
112 */
113int cap_settime(const struct timespec64 *ts, const struct timezone *tz)
114{
115 if (!capable(CAP_SYS_TIME))
116 return -EPERM;
117 return 0;
118}
119
120/**
121 * cap_ptrace_access_check - Determine whether the current process may access
122 * another
123 * @child: The process to be accessed
124 * @mode: The mode of attachment.
125 *
126 * If we are in the same or an ancestor user_ns and have all the target
127 * task's capabilities, then ptrace access is allowed.
128 * If we have the ptrace capability to the target user_ns, then ptrace
129 * access is allowed.
130 * Else denied.
131 *
132 * Determine whether a process may access another, returning 0 if permission
133 * granted, -ve if denied.
134 */
135int cap_ptrace_access_check(struct task_struct *child, unsigned int mode)
136{
137 int ret = 0;
138 const struct cred *cred, *child_cred;
139 const kernel_cap_t *caller_caps;
140
141 rcu_read_lock();
142 cred = current_cred();
143 child_cred = __task_cred(child);
144 if (mode & PTRACE_MODE_FSCREDS)
145 caller_caps = &cred->cap_effective;
146 else
147 caller_caps = &cred->cap_permitted;
148 if (cred->user_ns == child_cred->user_ns &&
149 cap_issubset(child_cred->cap_permitted, *caller_caps))
150 goto out;
151 if (ns_capable(child_cred->user_ns, CAP_SYS_PTRACE))
152 goto out;
153 ret = -EPERM;
154out:
155 rcu_read_unlock();
156 return ret;
157}
158
159/**
160 * cap_ptrace_traceme - Determine whether another process may trace the current
161 * @parent: The task proposed to be the tracer
162 *
163 * If parent is in the same or an ancestor user_ns and has all current's
164 * capabilities, then ptrace access is allowed.
165 * If parent has the ptrace capability to current's user_ns, then ptrace
166 * access is allowed.
167 * Else denied.
168 *
169 * Determine whether the nominated task is permitted to trace the current
170 * process, returning 0 if permission is granted, -ve if denied.
171 */
172int cap_ptrace_traceme(struct task_struct *parent)
173{
174 int ret = 0;
175 const struct cred *cred, *child_cred;
176
177 rcu_read_lock();
178 cred = __task_cred(parent);
179 child_cred = current_cred();
180 if (cred->user_ns == child_cred->user_ns &&
181 cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
182 goto out;
183 if (has_ns_capability(parent, child_cred->user_ns, CAP_SYS_PTRACE))
184 goto out;
185 ret = -EPERM;
186out:
187 rcu_read_unlock();
188 return ret;
189}
190
191/**
192 * cap_capget - Retrieve a task's capability sets
193 * @target: The task from which to retrieve the capability sets
194 * @effective: The place to record the effective set
195 * @inheritable: The place to record the inheritable set
196 * @permitted: The place to record the permitted set
197 *
198 * This function retrieves the capabilities of the nominated task and returns
199 * them to the caller.
200 */
201int cap_capget(const struct task_struct *target, kernel_cap_t *effective,
202 kernel_cap_t *inheritable, kernel_cap_t *permitted)
203{
204 const struct cred *cred;
205
206 /* Derived from kernel/capability.c:sys_capget. */
207 rcu_read_lock();
208 cred = __task_cred(target);
209 *effective = cred->cap_effective;
210 *inheritable = cred->cap_inheritable;
211 *permitted = cred->cap_permitted;
212 rcu_read_unlock();
213 return 0;
214}
215
216/*
217 * Determine whether the inheritable capabilities are limited to the old
218 * permitted set. Returns 1 if they are limited, 0 if they are not.
219 */
220static inline int cap_inh_is_capped(void)
221{
222 /* they are so limited unless the current task has the CAP_SETPCAP
223 * capability
224 */
225 if (cap_capable(current_cred(), current_cred()->user_ns,
226 CAP_SETPCAP, CAP_OPT_NONE) == 0)
227 return 0;
228 return 1;
229}
230
231/**
232 * cap_capset - Validate and apply proposed changes to current's capabilities
233 * @new: The proposed new credentials; alterations should be made here
234 * @old: The current task's current credentials
235 * @effective: A pointer to the proposed new effective capabilities set
236 * @inheritable: A pointer to the proposed new inheritable capabilities set
237 * @permitted: A pointer to the proposed new permitted capabilities set
238 *
239 * This function validates and applies a proposed mass change to the current
240 * process's capability sets. The changes are made to the proposed new
241 * credentials, and assuming no error, will be committed by the caller of LSM.
242 */
243int cap_capset(struct cred *new,
244 const struct cred *old,
245 const kernel_cap_t *effective,
246 const kernel_cap_t *inheritable,
247 const kernel_cap_t *permitted)
248{
249 if (cap_inh_is_capped() &&
250 !cap_issubset(*inheritable,
251 cap_combine(old->cap_inheritable,
252 old->cap_permitted)))
253 /* incapable of using this inheritable set */
254 return -EPERM;
255
256 if (!cap_issubset(*inheritable,
257 cap_combine(old->cap_inheritable,
258 old->cap_bset)))
259 /* no new pI capabilities outside bounding set */
260 return -EPERM;
261
262 /* verify restrictions on target's new Permitted set */
263 if (!cap_issubset(*permitted, old->cap_permitted))
264 return -EPERM;
265
266 /* verify the _new_Effective_ is a subset of the _new_Permitted_ */
267 if (!cap_issubset(*effective, *permitted))
268 return -EPERM;
269
270 new->cap_effective = *effective;
271 new->cap_inheritable = *inheritable;
272 new->cap_permitted = *permitted;
273
274 /*
275 * Mask off ambient bits that are no longer both permitted and
276 * inheritable.
277 */
278 new->cap_ambient = cap_intersect(new->cap_ambient,
279 cap_intersect(*permitted,
280 *inheritable));
281 if (WARN_ON(!cap_ambient_invariant_ok(new)))
282 return -EINVAL;
283 return 0;
284}
285
286/**
287 * cap_inode_need_killpriv - Determine if inode change affects privileges
288 * @dentry: The inode/dentry in being changed with change marked ATTR_KILL_PRIV
289 *
290 * Determine if an inode having a change applied that's marked ATTR_KILL_PRIV
291 * affects the security markings on that inode, and if it is, should
292 * inode_killpriv() be invoked or the change rejected.
293 *
294 * Return: 1 if security.capability has a value, meaning inode_killpriv()
295 * is required, 0 otherwise, meaning inode_killpriv() is not required.
296 */
297int cap_inode_need_killpriv(struct dentry *dentry)
298{
299 struct inode *inode = d_backing_inode(dentry);
300 int error;
301
302 error = __vfs_getxattr(dentry, inode, XATTR_NAME_CAPS, NULL, 0);
303 return error > 0;
304}
305
306/**
307 * cap_inode_killpriv - Erase the security markings on an inode
308 *
309 * @idmap: idmap of the mount the inode was found from
310 * @dentry: The inode/dentry to alter
311 *
312 * Erase the privilege-enhancing security markings on an inode.
313 *
314 * If the inode has been found through an idmapped mount the idmap of
315 * the vfsmount must be passed through @idmap. This function will then
316 * take care to map the inode according to @idmap before checking
317 * permissions. On non-idmapped mounts or if permission checking is to be
318 * performed on the raw inode simply pass @nop_mnt_idmap.
319 *
320 * Return: 0 if successful, -ve on error.
321 */
322int cap_inode_killpriv(struct mnt_idmap *idmap, struct dentry *dentry)
323{
324 int error;
325
326 error = __vfs_removexattr(idmap, dentry, XATTR_NAME_CAPS);
327 if (error == -EOPNOTSUPP)
328 error = 0;
329 return error;
330}
331
332static bool rootid_owns_currentns(vfsuid_t rootvfsuid)
333{
334 struct user_namespace *ns;
335 kuid_t kroot;
336
337 if (!vfsuid_valid(rootvfsuid))
338 return false;
339
340 kroot = vfsuid_into_kuid(rootvfsuid);
341 for (ns = current_user_ns();; ns = ns->parent) {
342 if (from_kuid(ns, kroot) == 0)
343 return true;
344 if (ns == &init_user_ns)
345 break;
346 }
347
348 return false;
349}
350
351static __u32 sansflags(__u32 m)
352{
353 return m & ~VFS_CAP_FLAGS_EFFECTIVE;
354}
355
356static bool is_v2header(int size, const struct vfs_cap_data *cap)
357{
358 if (size != XATTR_CAPS_SZ_2)
359 return false;
360 return sansflags(le32_to_cpu(cap->magic_etc)) == VFS_CAP_REVISION_2;
361}
362
363static bool is_v3header(int size, const struct vfs_cap_data *cap)
364{
365 if (size != XATTR_CAPS_SZ_3)
366 return false;
367 return sansflags(le32_to_cpu(cap->magic_etc)) == VFS_CAP_REVISION_3;
368}
369
370/*
371 * getsecurity: We are called for security.* before any attempt to read the
372 * xattr from the inode itself.
373 *
374 * This gives us a chance to read the on-disk value and convert it. If we
375 * return -EOPNOTSUPP, then vfs_getxattr() will call the i_op handler.
376 *
377 * Note we are not called by vfs_getxattr_alloc(), but that is only called
378 * by the integrity subsystem, which really wants the unconverted values -
379 * so that's good.
380 */
381int cap_inode_getsecurity(struct mnt_idmap *idmap,
382 struct inode *inode, const char *name, void **buffer,
383 bool alloc)
384{
385 int size;
386 kuid_t kroot;
387 vfsuid_t vfsroot;
388 u32 nsmagic, magic;
389 uid_t root, mappedroot;
390 char *tmpbuf = NULL;
391 struct vfs_cap_data *cap;
392 struct vfs_ns_cap_data *nscap = NULL;
393 struct dentry *dentry;
394 struct user_namespace *fs_ns;
395
396 if (strcmp(name, "capability") != 0)
397 return -EOPNOTSUPP;
398
399 dentry = d_find_any_alias(inode);
400 if (!dentry)
401 return -EINVAL;
402 size = vfs_getxattr_alloc(idmap, dentry, XATTR_NAME_CAPS, &tmpbuf,
403 sizeof(struct vfs_ns_cap_data), GFP_NOFS);
404 dput(dentry);
405 /* gcc11 complains if we don't check for !tmpbuf */
406 if (size < 0 || !tmpbuf)
407 goto out_free;
408
409 fs_ns = inode->i_sb->s_user_ns;
410 cap = (struct vfs_cap_data *) tmpbuf;
411 if (is_v2header(size, cap)) {
412 root = 0;
413 } else if (is_v3header(size, cap)) {
414 nscap = (struct vfs_ns_cap_data *) tmpbuf;
415 root = le32_to_cpu(nscap->rootid);
416 } else {
417 size = -EINVAL;
418 goto out_free;
419 }
420
421 kroot = make_kuid(fs_ns, root);
422
423 /* If this is an idmapped mount shift the kuid. */
424 vfsroot = make_vfsuid(idmap, fs_ns, kroot);
425
426 /* If the root kuid maps to a valid uid in current ns, then return
427 * this as a nscap. */
428 mappedroot = from_kuid(current_user_ns(), vfsuid_into_kuid(vfsroot));
429 if (mappedroot != (uid_t)-1 && mappedroot != (uid_t)0) {
430 size = sizeof(struct vfs_ns_cap_data);
431 if (alloc) {
432 if (!nscap) {
433 /* v2 -> v3 conversion */
434 nscap = kzalloc(size, GFP_ATOMIC);
435 if (!nscap) {
436 size = -ENOMEM;
437 goto out_free;
438 }
439 nsmagic = VFS_CAP_REVISION_3;
440 magic = le32_to_cpu(cap->magic_etc);
441 if (magic & VFS_CAP_FLAGS_EFFECTIVE)
442 nsmagic |= VFS_CAP_FLAGS_EFFECTIVE;
443 memcpy(&nscap->data, &cap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
444 nscap->magic_etc = cpu_to_le32(nsmagic);
445 } else {
446 /* use allocated v3 buffer */
447 tmpbuf = NULL;
448 }
449 nscap->rootid = cpu_to_le32(mappedroot);
450 *buffer = nscap;
451 }
452 goto out_free;
453 }
454
455 if (!rootid_owns_currentns(vfsroot)) {
456 size = -EOVERFLOW;
457 goto out_free;
458 }
459
460 /* This comes from a parent namespace. Return as a v2 capability */
461 size = sizeof(struct vfs_cap_data);
462 if (alloc) {
463 if (nscap) {
464 /* v3 -> v2 conversion */
465 cap = kzalloc(size, GFP_ATOMIC);
466 if (!cap) {
467 size = -ENOMEM;
468 goto out_free;
469 }
470 magic = VFS_CAP_REVISION_2;
471 nsmagic = le32_to_cpu(nscap->magic_etc);
472 if (nsmagic & VFS_CAP_FLAGS_EFFECTIVE)
473 magic |= VFS_CAP_FLAGS_EFFECTIVE;
474 memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
475 cap->magic_etc = cpu_to_le32(magic);
476 } else {
477 /* use unconverted v2 */
478 tmpbuf = NULL;
479 }
480 *buffer = cap;
481 }
482out_free:
483 kfree(tmpbuf);
484 return size;
485}
486
487/**
488 * rootid_from_xattr - translate root uid of vfs caps
489 *
490 * @value: vfs caps value which may be modified by this function
491 * @size: size of @ivalue
492 * @task_ns: user namespace of the caller
493 */
494static vfsuid_t rootid_from_xattr(const void *value, size_t size,
495 struct user_namespace *task_ns)
496{
497 const struct vfs_ns_cap_data *nscap = value;
498 uid_t rootid = 0;
499
500 if (size == XATTR_CAPS_SZ_3)
501 rootid = le32_to_cpu(nscap->rootid);
502
503 return VFSUIDT_INIT(make_kuid(task_ns, rootid));
504}
505
506static bool validheader(size_t size, const struct vfs_cap_data *cap)
507{
508 return is_v2header(size, cap) || is_v3header(size, cap);
509}
510
511/**
512 * cap_convert_nscap - check vfs caps
513 *
514 * @idmap: idmap of the mount the inode was found from
515 * @dentry: used to retrieve inode to check permissions on
516 * @ivalue: vfs caps value which may be modified by this function
517 * @size: size of @ivalue
518 *
519 * User requested a write of security.capability. If needed, update the
520 * xattr to change from v2 to v3, or to fixup the v3 rootid.
521 *
522 * If the inode has been found through an idmapped mount the idmap of
523 * the vfsmount must be passed through @idmap. This function will then
524 * take care to map the inode according to @idmap before checking
525 * permissions. On non-idmapped mounts or if permission checking is to be
526 * performed on the raw inode simply pass @nop_mnt_idmap.
527 *
528 * Return: On success, return the new size; on error, return < 0.
529 */
530int cap_convert_nscap(struct mnt_idmap *idmap, struct dentry *dentry,
531 const void **ivalue, size_t size)
532{
533 struct vfs_ns_cap_data *nscap;
534 uid_t nsrootid;
535 const struct vfs_cap_data *cap = *ivalue;
536 __u32 magic, nsmagic;
537 struct inode *inode = d_backing_inode(dentry);
538 struct user_namespace *task_ns = current_user_ns(),
539 *fs_ns = inode->i_sb->s_user_ns;
540 kuid_t rootid;
541 vfsuid_t vfsrootid;
542 size_t newsize;
543
544 if (!*ivalue)
545 return -EINVAL;
546 if (!validheader(size, cap))
547 return -EINVAL;
548 if (!capable_wrt_inode_uidgid(idmap, inode, CAP_SETFCAP))
549 return -EPERM;
550 if (size == XATTR_CAPS_SZ_2 && (idmap == &nop_mnt_idmap))
551 if (ns_capable(inode->i_sb->s_user_ns, CAP_SETFCAP))
552 /* user is privileged, just write the v2 */
553 return size;
554
555 vfsrootid = rootid_from_xattr(*ivalue, size, task_ns);
556 if (!vfsuid_valid(vfsrootid))
557 return -EINVAL;
558
559 rootid = from_vfsuid(idmap, fs_ns, vfsrootid);
560 if (!uid_valid(rootid))
561 return -EINVAL;
562
563 nsrootid = from_kuid(fs_ns, rootid);
564 if (nsrootid == -1)
565 return -EINVAL;
566
567 newsize = sizeof(struct vfs_ns_cap_data);
568 nscap = kmalloc(newsize, GFP_ATOMIC);
569 if (!nscap)
570 return -ENOMEM;
571 nscap->rootid = cpu_to_le32(nsrootid);
572 nsmagic = VFS_CAP_REVISION_3;
573 magic = le32_to_cpu(cap->magic_etc);
574 if (magic & VFS_CAP_FLAGS_EFFECTIVE)
575 nsmagic |= VFS_CAP_FLAGS_EFFECTIVE;
576 nscap->magic_etc = cpu_to_le32(nsmagic);
577 memcpy(&nscap->data, &cap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
578
579 *ivalue = nscap;
580 return newsize;
581}
582
583/*
584 * Calculate the new process capability sets from the capability sets attached
585 * to a file.
586 */
587static inline int bprm_caps_from_vfs_caps(struct cpu_vfs_cap_data *caps,
588 struct linux_binprm *bprm,
589 bool *effective,
590 bool *has_fcap)
591{
592 struct cred *new = bprm->cred;
593 int ret = 0;
594
595 if (caps->magic_etc & VFS_CAP_FLAGS_EFFECTIVE)
596 *effective = true;
597
598 if (caps->magic_etc & VFS_CAP_REVISION_MASK)
599 *has_fcap = true;
600
601 /*
602 * pP' = (X & fP) | (pI & fI)
603 * The addition of pA' is handled later.
604 */
605 new->cap_permitted.val =
606 (new->cap_bset.val & caps->permitted.val) |
607 (new->cap_inheritable.val & caps->inheritable.val);
608
609 if (caps->permitted.val & ~new->cap_permitted.val)
610 /* insufficient to execute correctly */
611 ret = -EPERM;
612
613 /*
614 * For legacy apps, with no internal support for recognizing they
615 * do not have enough capabilities, we return an error if they are
616 * missing some "forced" (aka file-permitted) capabilities.
617 */
618 return *effective ? ret : 0;
619}
620
621/**
622 * get_vfs_caps_from_disk - retrieve vfs caps from disk
623 *
624 * @idmap: idmap of the mount the inode was found from
625 * @dentry: dentry from which @inode is retrieved
626 * @cpu_caps: vfs capabilities
627 *
628 * Extract the on-exec-apply capability sets for an executable file.
629 *
630 * If the inode has been found through an idmapped mount the idmap of
631 * the vfsmount must be passed through @idmap. This function will then
632 * take care to map the inode according to @idmap before checking
633 * permissions. On non-idmapped mounts or if permission checking is to be
634 * performed on the raw inode simply pass @nop_mnt_idmap.
635 */
636int get_vfs_caps_from_disk(struct mnt_idmap *idmap,
637 const struct dentry *dentry,
638 struct cpu_vfs_cap_data *cpu_caps)
639{
640 struct inode *inode = d_backing_inode(dentry);
641 __u32 magic_etc;
642 int size;
643 struct vfs_ns_cap_data data, *nscaps = &data;
644 struct vfs_cap_data *caps = (struct vfs_cap_data *) &data;
645 kuid_t rootkuid;
646 vfsuid_t rootvfsuid;
647 struct user_namespace *fs_ns;
648
649 memset(cpu_caps, 0, sizeof(struct cpu_vfs_cap_data));
650
651 if (!inode)
652 return -ENODATA;
653
654 fs_ns = inode->i_sb->s_user_ns;
655 size = __vfs_getxattr((struct dentry *)dentry, inode,
656 XATTR_NAME_CAPS, &data, XATTR_CAPS_SZ);
657 if (size == -ENODATA || size == -EOPNOTSUPP)
658 /* no data, that's ok */
659 return -ENODATA;
660
661 if (size < 0)
662 return size;
663
664 if (size < sizeof(magic_etc))
665 return -EINVAL;
666
667 cpu_caps->magic_etc = magic_etc = le32_to_cpu(caps->magic_etc);
668
669 rootkuid = make_kuid(fs_ns, 0);
670 switch (magic_etc & VFS_CAP_REVISION_MASK) {
671 case VFS_CAP_REVISION_1:
672 if (size != XATTR_CAPS_SZ_1)
673 return -EINVAL;
674 break;
675 case VFS_CAP_REVISION_2:
676 if (size != XATTR_CAPS_SZ_2)
677 return -EINVAL;
678 break;
679 case VFS_CAP_REVISION_3:
680 if (size != XATTR_CAPS_SZ_3)
681 return -EINVAL;
682 rootkuid = make_kuid(fs_ns, le32_to_cpu(nscaps->rootid));
683 break;
684
685 default:
686 return -EINVAL;
687 }
688
689 rootvfsuid = make_vfsuid(idmap, fs_ns, rootkuid);
690 if (!vfsuid_valid(rootvfsuid))
691 return -ENODATA;
692
693 /* Limit the caps to the mounter of the filesystem
694 * or the more limited uid specified in the xattr.
695 */
696 if (!rootid_owns_currentns(rootvfsuid))
697 return -ENODATA;
698
699 cpu_caps->permitted.val = le32_to_cpu(caps->data[0].permitted);
700 cpu_caps->inheritable.val = le32_to_cpu(caps->data[0].inheritable);
701
702 /*
703 * Rev1 had just a single 32-bit word, later expanded
704 * to a second one for the high bits
705 */
706 if ((magic_etc & VFS_CAP_REVISION_MASK) != VFS_CAP_REVISION_1) {
707 cpu_caps->permitted.val += (u64)le32_to_cpu(caps->data[1].permitted) << 32;
708 cpu_caps->inheritable.val += (u64)le32_to_cpu(caps->data[1].inheritable) << 32;
709 }
710
711 cpu_caps->permitted.val &= CAP_VALID_MASK;
712 cpu_caps->inheritable.val &= CAP_VALID_MASK;
713
714 cpu_caps->rootid = vfsuid_into_kuid(rootvfsuid);
715
716 return 0;
717}
718
719/*
720 * Attempt to get the on-exec apply capability sets for an executable file from
721 * its xattrs and, if present, apply them to the proposed credentials being
722 * constructed by execve().
723 */
724static int get_file_caps(struct linux_binprm *bprm, const struct file *file,
725 bool *effective, bool *has_fcap)
726{
727 int rc = 0;
728 struct cpu_vfs_cap_data vcaps;
729
730 cap_clear(bprm->cred->cap_permitted);
731
732 if (!file_caps_enabled)
733 return 0;
734
735 if (!mnt_may_suid(file->f_path.mnt))
736 return 0;
737
738 /*
739 * This check is redundant with mnt_may_suid() but is kept to make
740 * explicit that capability bits are limited to s_user_ns and its
741 * descendants.
742 */
743 if (!current_in_userns(file->f_path.mnt->mnt_sb->s_user_ns))
744 return 0;
745
746 rc = get_vfs_caps_from_disk(file_mnt_idmap(file),
747 file->f_path.dentry, &vcaps);
748 if (rc < 0) {
749 if (rc == -EINVAL)
750 printk(KERN_NOTICE "Invalid argument reading file caps for %s\n",
751 bprm->filename);
752 else if (rc == -ENODATA)
753 rc = 0;
754 goto out;
755 }
756
757 rc = bprm_caps_from_vfs_caps(&vcaps, bprm, effective, has_fcap);
758
759out:
760 if (rc)
761 cap_clear(bprm->cred->cap_permitted);
762
763 return rc;
764}
765
766static inline bool root_privileged(void) { return !issecure(SECURE_NOROOT); }
767
768static inline bool __is_real(kuid_t uid, struct cred *cred)
769{ return uid_eq(cred->uid, uid); }
770
771static inline bool __is_eff(kuid_t uid, struct cred *cred)
772{ return uid_eq(cred->euid, uid); }
773
774static inline bool __is_suid(kuid_t uid, struct cred *cred)
775{ return !__is_real(uid, cred) && __is_eff(uid, cred); }
776
777/*
778 * handle_privileged_root - Handle case of privileged root
779 * @bprm: The execution parameters, including the proposed creds
780 * @has_fcap: Are any file capabilities set?
781 * @effective: Do we have effective root privilege?
782 * @root_uid: This namespace' root UID WRT initial USER namespace
783 *
784 * Handle the case where root is privileged and hasn't been neutered by
785 * SECURE_NOROOT. If file capabilities are set, they won't be combined with
786 * set UID root and nothing is changed. If we are root, cap_permitted is
787 * updated. If we have become set UID root, the effective bit is set.
788 */
789static void handle_privileged_root(struct linux_binprm *bprm, bool has_fcap,
790 bool *effective, kuid_t root_uid)
791{
792 const struct cred *old = current_cred();
793 struct cred *new = bprm->cred;
794
795 if (!root_privileged())
796 return;
797 /*
798 * If the legacy file capability is set, then don't set privs
799 * for a setuid root binary run by a non-root user. Do set it
800 * for a root user just to cause least surprise to an admin.
801 */
802 if (has_fcap && __is_suid(root_uid, new)) {
803 warn_setuid_and_fcaps_mixed(bprm->filename);
804 return;
805 }
806 /*
807 * To support inheritance of root-permissions and suid-root
808 * executables under compatibility mode, we override the
809 * capability sets for the file.
810 */
811 if (__is_eff(root_uid, new) || __is_real(root_uid, new)) {
812 /* pP' = (cap_bset & ~0) | (pI & ~0) */
813 new->cap_permitted = cap_combine(old->cap_bset,
814 old->cap_inheritable);
815 }
816 /*
817 * If only the real uid is 0, we do not set the effective bit.
818 */
819 if (__is_eff(root_uid, new))
820 *effective = true;
821}
822
823#define __cap_gained(field, target, source) \
824 !cap_issubset(target->cap_##field, source->cap_##field)
825#define __cap_grew(target, source, cred) \
826 !cap_issubset(cred->cap_##target, cred->cap_##source)
827#define __cap_full(field, cred) \
828 cap_issubset(CAP_FULL_SET, cred->cap_##field)
829
830static inline bool __is_setuid(struct cred *new, const struct cred *old)
831{ return !uid_eq(new->euid, old->uid); }
832
833static inline bool __is_setgid(struct cred *new, const struct cred *old)
834{ return !gid_eq(new->egid, old->gid); }
835
836/*
837 * 1) Audit candidate if current->cap_effective is set
838 *
839 * We do not bother to audit if 3 things are true:
840 * 1) cap_effective has all caps
841 * 2) we became root *OR* are were already root
842 * 3) root is supposed to have all caps (SECURE_NOROOT)
843 * Since this is just a normal root execing a process.
844 *
845 * Number 1 above might fail if you don't have a full bset, but I think
846 * that is interesting information to audit.
847 *
848 * A number of other conditions require logging:
849 * 2) something prevented setuid root getting all caps
850 * 3) non-setuid root gets fcaps
851 * 4) non-setuid root gets ambient
852 */
853static inline bool nonroot_raised_pE(struct cred *new, const struct cred *old,
854 kuid_t root, bool has_fcap)
855{
856 bool ret = false;
857
858 if ((__cap_grew(effective, ambient, new) &&
859 !(__cap_full(effective, new) &&
860 (__is_eff(root, new) || __is_real(root, new)) &&
861 root_privileged())) ||
862 (root_privileged() &&
863 __is_suid(root, new) &&
864 !__cap_full(effective, new)) ||
865 (!__is_setuid(new, old) &&
866 ((has_fcap &&
867 __cap_gained(permitted, new, old)) ||
868 __cap_gained(ambient, new, old))))
869
870 ret = true;
871
872 return ret;
873}
874
875/**
876 * cap_bprm_creds_from_file - Set up the proposed credentials for execve().
877 * @bprm: The execution parameters, including the proposed creds
878 * @file: The file to pull the credentials from
879 *
880 * Set up the proposed credentials for a new execution context being
881 * constructed by execve(). The proposed creds in @bprm->cred is altered,
882 * which won't take effect immediately.
883 *
884 * Return: 0 if successful, -ve on error.
885 */
886int cap_bprm_creds_from_file(struct linux_binprm *bprm, const struct file *file)
887{
888 /* Process setpcap binaries and capabilities for uid 0 */
889 const struct cred *old = current_cred();
890 struct cred *new = bprm->cred;
891 bool effective = false, has_fcap = false, is_setid;
892 int ret;
893 kuid_t root_uid;
894
895 if (WARN_ON(!cap_ambient_invariant_ok(old)))
896 return -EPERM;
897
898 ret = get_file_caps(bprm, file, &effective, &has_fcap);
899 if (ret < 0)
900 return ret;
901
902 root_uid = make_kuid(new->user_ns, 0);
903
904 handle_privileged_root(bprm, has_fcap, &effective, root_uid);
905
906 /* if we have fs caps, clear dangerous personality flags */
907 if (__cap_gained(permitted, new, old))
908 bprm->per_clear |= PER_CLEAR_ON_SETID;
909
910 /* Don't let someone trace a set[ug]id/setpcap binary with the revised
911 * credentials unless they have the appropriate permit.
912 *
913 * In addition, if NO_NEW_PRIVS, then ensure we get no new privs.
914 */
915 is_setid = __is_setuid(new, old) || __is_setgid(new, old);
916
917 if ((is_setid || __cap_gained(permitted, new, old)) &&
918 ((bprm->unsafe & ~LSM_UNSAFE_PTRACE) ||
919 !ptracer_capable(current, new->user_ns))) {
920 /* downgrade; they get no more than they had, and maybe less */
921 if (!ns_capable(new->user_ns, CAP_SETUID) ||
922 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)) {
923 new->euid = new->uid;
924 new->egid = new->gid;
925 }
926 new->cap_permitted = cap_intersect(new->cap_permitted,
927 old->cap_permitted);
928 }
929
930 new->suid = new->fsuid = new->euid;
931 new->sgid = new->fsgid = new->egid;
932
933 /* File caps or setid cancels ambient. */
934 if (has_fcap || is_setid)
935 cap_clear(new->cap_ambient);
936
937 /*
938 * Now that we've computed pA', update pP' to give:
939 * pP' = (X & fP) | (pI & fI) | pA'
940 */
941 new->cap_permitted = cap_combine(new->cap_permitted, new->cap_ambient);
942
943 /*
944 * Set pE' = (fE ? pP' : pA'). Because pA' is zero if fE is set,
945 * this is the same as pE' = (fE ? pP' : 0) | pA'.
946 */
947 if (effective)
948 new->cap_effective = new->cap_permitted;
949 else
950 new->cap_effective = new->cap_ambient;
951
952 if (WARN_ON(!cap_ambient_invariant_ok(new)))
953 return -EPERM;
954
955 if (nonroot_raised_pE(new, old, root_uid, has_fcap)) {
956 ret = audit_log_bprm_fcaps(bprm, new, old);
957 if (ret < 0)
958 return ret;
959 }
960
961 new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
962
963 if (WARN_ON(!cap_ambient_invariant_ok(new)))
964 return -EPERM;
965
966 /* Check for privilege-elevated exec. */
967 if (is_setid ||
968 (!__is_real(root_uid, new) &&
969 (effective ||
970 __cap_grew(permitted, ambient, new))))
971 bprm->secureexec = 1;
972
973 return 0;
974}
975
976/**
977 * cap_inode_setxattr - Determine whether an xattr may be altered
978 * @dentry: The inode/dentry being altered
979 * @name: The name of the xattr to be changed
980 * @value: The value that the xattr will be changed to
981 * @size: The size of value
982 * @flags: The replacement flag
983 *
984 * Determine whether an xattr may be altered or set on an inode, returning 0 if
985 * permission is granted, -ve if denied.
986 *
987 * This is used to make sure security xattrs don't get updated or set by those
988 * who aren't privileged to do so.
989 */
990int cap_inode_setxattr(struct dentry *dentry, const char *name,
991 const void *value, size_t size, int flags)
992{
993 struct user_namespace *user_ns = dentry->d_sb->s_user_ns;
994
995 /* Ignore non-security xattrs */
996 if (strncmp(name, XATTR_SECURITY_PREFIX,
997 XATTR_SECURITY_PREFIX_LEN) != 0)
998 return 0;
999
1000 /*
1001 * For XATTR_NAME_CAPS the check will be done in
1002 * cap_convert_nscap(), called by setxattr()
1003 */
1004 if (strcmp(name, XATTR_NAME_CAPS) == 0)
1005 return 0;
1006
1007 if (!ns_capable(user_ns, CAP_SYS_ADMIN))
1008 return -EPERM;
1009 return 0;
1010}
1011
1012/**
1013 * cap_inode_removexattr - Determine whether an xattr may be removed
1014 *
1015 * @idmap: idmap of the mount the inode was found from
1016 * @dentry: The inode/dentry being altered
1017 * @name: The name of the xattr to be changed
1018 *
1019 * Determine whether an xattr may be removed from an inode, returning 0 if
1020 * permission is granted, -ve if denied.
1021 *
1022 * If the inode has been found through an idmapped mount the idmap of
1023 * the vfsmount must be passed through @idmap. This function will then
1024 * take care to map the inode according to @idmap before checking
1025 * permissions. On non-idmapped mounts or if permission checking is to be
1026 * performed on the raw inode simply pass @nop_mnt_idmap.
1027 *
1028 * This is used to make sure security xattrs don't get removed by those who
1029 * aren't privileged to remove them.
1030 */
1031int cap_inode_removexattr(struct mnt_idmap *idmap,
1032 struct dentry *dentry, const char *name)
1033{
1034 struct user_namespace *user_ns = dentry->d_sb->s_user_ns;
1035
1036 /* Ignore non-security xattrs */
1037 if (strncmp(name, XATTR_SECURITY_PREFIX,
1038 XATTR_SECURITY_PREFIX_LEN) != 0)
1039 return 0;
1040
1041 if (strcmp(name, XATTR_NAME_CAPS) == 0) {
1042 /* security.capability gets namespaced */
1043 struct inode *inode = d_backing_inode(dentry);
1044 if (!inode)
1045 return -EINVAL;
1046 if (!capable_wrt_inode_uidgid(idmap, inode, CAP_SETFCAP))
1047 return -EPERM;
1048 return 0;
1049 }
1050
1051 if (!ns_capable(user_ns, CAP_SYS_ADMIN))
1052 return -EPERM;
1053 return 0;
1054}
1055
1056/*
1057 * cap_emulate_setxuid() fixes the effective / permitted capabilities of
1058 * a process after a call to setuid, setreuid, or setresuid.
1059 *
1060 * 1) When set*uiding _from_ one of {r,e,s}uid == 0 _to_ all of
1061 * {r,e,s}uid != 0, the permitted and effective capabilities are
1062 * cleared.
1063 *
1064 * 2) When set*uiding _from_ euid == 0 _to_ euid != 0, the effective
1065 * capabilities of the process are cleared.
1066 *
1067 * 3) When set*uiding _from_ euid != 0 _to_ euid == 0, the effective
1068 * capabilities are set to the permitted capabilities.
1069 *
1070 * fsuid is handled elsewhere. fsuid == 0 and {r,e,s}uid!= 0 should
1071 * never happen.
1072 *
1073 * -astor
1074 *
1075 * cevans - New behaviour, Oct '99
1076 * A process may, via prctl(), elect to keep its capabilities when it
1077 * calls setuid() and switches away from uid==0. Both permitted and
1078 * effective sets will be retained.
1079 * Without this change, it was impossible for a daemon to drop only some
1080 * of its privilege. The call to setuid(!=0) would drop all privileges!
1081 * Keeping uid 0 is not an option because uid 0 owns too many vital
1082 * files..
1083 * Thanks to Olaf Kirch and Peter Benie for spotting this.
1084 */
1085static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)
1086{
1087 kuid_t root_uid = make_kuid(old->user_ns, 0);
1088
1089 if ((uid_eq(old->uid, root_uid) ||
1090 uid_eq(old->euid, root_uid) ||
1091 uid_eq(old->suid, root_uid)) &&
1092 (!uid_eq(new->uid, root_uid) &&
1093 !uid_eq(new->euid, root_uid) &&
1094 !uid_eq(new->suid, root_uid))) {
1095 if (!issecure(SECURE_KEEP_CAPS)) {
1096 cap_clear(new->cap_permitted);
1097 cap_clear(new->cap_effective);
1098 }
1099
1100 /*
1101 * Pre-ambient programs expect setresuid to nonroot followed
1102 * by exec to drop capabilities. We should make sure that
1103 * this remains the case.
1104 */
1105 cap_clear(new->cap_ambient);
1106 }
1107 if (uid_eq(old->euid, root_uid) && !uid_eq(new->euid, root_uid))
1108 cap_clear(new->cap_effective);
1109 if (!uid_eq(old->euid, root_uid) && uid_eq(new->euid, root_uid))
1110 new->cap_effective = new->cap_permitted;
1111}
1112
1113/**
1114 * cap_task_fix_setuid - Fix up the results of setuid() call
1115 * @new: The proposed credentials
1116 * @old: The current task's current credentials
1117 * @flags: Indications of what has changed
1118 *
1119 * Fix up the results of setuid() call before the credential changes are
1120 * actually applied.
1121 *
1122 * Return: 0 to grant the changes, -ve to deny them.
1123 */
1124int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
1125{
1126 switch (flags) {
1127 case LSM_SETID_RE:
1128 case LSM_SETID_ID:
1129 case LSM_SETID_RES:
1130 /* juggle the capabilities to follow [RES]UID changes unless
1131 * otherwise suppressed */
1132 if (!issecure(SECURE_NO_SETUID_FIXUP))
1133 cap_emulate_setxuid(new, old);
1134 break;
1135
1136 case LSM_SETID_FS:
1137 /* juggle the capabilities to follow FSUID changes, unless
1138 * otherwise suppressed
1139 *
1140 * FIXME - is fsuser used for all CAP_FS_MASK capabilities?
1141 * if not, we might be a bit too harsh here.
1142 */
1143 if (!issecure(SECURE_NO_SETUID_FIXUP)) {
1144 kuid_t root_uid = make_kuid(old->user_ns, 0);
1145 if (uid_eq(old->fsuid, root_uid) && !uid_eq(new->fsuid, root_uid))
1146 new->cap_effective =
1147 cap_drop_fs_set(new->cap_effective);
1148
1149 if (!uid_eq(old->fsuid, root_uid) && uid_eq(new->fsuid, root_uid))
1150 new->cap_effective =
1151 cap_raise_fs_set(new->cap_effective,
1152 new->cap_permitted);
1153 }
1154 break;
1155
1156 default:
1157 return -EINVAL;
1158 }
1159
1160 return 0;
1161}
1162
1163/*
1164 * Rationale: code calling task_setscheduler, task_setioprio, and
1165 * task_setnice, assumes that
1166 * . if capable(cap_sys_nice), then those actions should be allowed
1167 * . if not capable(cap_sys_nice), but acting on your own processes,
1168 * then those actions should be allowed
1169 * This is insufficient now since you can call code without suid, but
1170 * yet with increased caps.
1171 * So we check for increased caps on the target process.
1172 */
1173static int cap_safe_nice(struct task_struct *p)
1174{
1175 int is_subset, ret = 0;
1176
1177 rcu_read_lock();
1178 is_subset = cap_issubset(__task_cred(p)->cap_permitted,
1179 current_cred()->cap_permitted);
1180 if (!is_subset && !ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE))
1181 ret = -EPERM;
1182 rcu_read_unlock();
1183
1184 return ret;
1185}
1186
1187/**
1188 * cap_task_setscheduler - Determine if scheduler policy change is permitted
1189 * @p: The task to affect
1190 *
1191 * Determine if the requested scheduler policy change is permitted for the
1192 * specified task.
1193 *
1194 * Return: 0 if permission is granted, -ve if denied.
1195 */
1196int cap_task_setscheduler(struct task_struct *p)
1197{
1198 return cap_safe_nice(p);
1199}
1200
1201/**
1202 * cap_task_setioprio - Determine if I/O priority change is permitted
1203 * @p: The task to affect
1204 * @ioprio: The I/O priority to set
1205 *
1206 * Determine if the requested I/O priority change is permitted for the specified
1207 * task.
1208 *
1209 * Return: 0 if permission is granted, -ve if denied.
1210 */
1211int cap_task_setioprio(struct task_struct *p, int ioprio)
1212{
1213 return cap_safe_nice(p);
1214}
1215
1216/**
1217 * cap_task_setnice - Determine if task priority change is permitted
1218 * @p: The task to affect
1219 * @nice: The nice value to set
1220 *
1221 * Determine if the requested task priority change is permitted for the
1222 * specified task.
1223 *
1224 * Return: 0 if permission is granted, -ve if denied.
1225 */
1226int cap_task_setnice(struct task_struct *p, int nice)
1227{
1228 return cap_safe_nice(p);
1229}
1230
1231/*
1232 * Implement PR_CAPBSET_DROP. Attempt to remove the specified capability from
1233 * the current task's bounding set. Returns 0 on success, -ve on error.
1234 */
1235static int cap_prctl_drop(unsigned long cap)
1236{
1237 struct cred *new;
1238
1239 if (!ns_capable(current_user_ns(), CAP_SETPCAP))
1240 return -EPERM;
1241 if (!cap_valid(cap))
1242 return -EINVAL;
1243
1244 new = prepare_creds();
1245 if (!new)
1246 return -ENOMEM;
1247 cap_lower(new->cap_bset, cap);
1248 return commit_creds(new);
1249}
1250
1251/**
1252 * cap_task_prctl - Implement process control functions for this security module
1253 * @option: The process control function requested
1254 * @arg2: The argument data for this function
1255 * @arg3: The argument data for this function
1256 * @arg4: The argument data for this function
1257 * @arg5: The argument data for this function
1258 *
1259 * Allow process control functions (sys_prctl()) to alter capabilities; may
1260 * also deny access to other functions not otherwise implemented here.
1261 *
1262 * Return: 0 or +ve on success, -ENOSYS if this function is not implemented
1263 * here, other -ve on error. If -ENOSYS is returned, sys_prctl() and other LSM
1264 * modules will consider performing the function.
1265 */
1266int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
1267 unsigned long arg4, unsigned long arg5)
1268{
1269 const struct cred *old = current_cred();
1270 struct cred *new;
1271
1272 switch (option) {
1273 case PR_CAPBSET_READ:
1274 if (!cap_valid(arg2))
1275 return -EINVAL;
1276 return !!cap_raised(old->cap_bset, arg2);
1277
1278 case PR_CAPBSET_DROP:
1279 return cap_prctl_drop(arg2);
1280
1281 /*
1282 * The next four prctl's remain to assist with transitioning a
1283 * system from legacy UID=0 based privilege (when filesystem
1284 * capabilities are not in use) to a system using filesystem
1285 * capabilities only - as the POSIX.1e draft intended.
1286 *
1287 * Note:
1288 *
1289 * PR_SET_SECUREBITS =
1290 * issecure_mask(SECURE_KEEP_CAPS_LOCKED)
1291 * | issecure_mask(SECURE_NOROOT)
1292 * | issecure_mask(SECURE_NOROOT_LOCKED)
1293 * | issecure_mask(SECURE_NO_SETUID_FIXUP)
1294 * | issecure_mask(SECURE_NO_SETUID_FIXUP_LOCKED)
1295 *
1296 * will ensure that the current process and all of its
1297 * children will be locked into a pure
1298 * capability-based-privilege environment.
1299 */
1300 case PR_SET_SECUREBITS:
1301 if ((((old->securebits & SECURE_ALL_LOCKS) >> 1)
1302 & (old->securebits ^ arg2)) /*[1]*/
1303 || ((old->securebits & SECURE_ALL_LOCKS & ~arg2)) /*[2]*/
1304 || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS)) /*[3]*/
1305 || (cap_capable(current_cred(),
1306 current_cred()->user_ns,
1307 CAP_SETPCAP,
1308 CAP_OPT_NONE) != 0) /*[4]*/
1309 /*
1310 * [1] no changing of bits that are locked
1311 * [2] no unlocking of locks
1312 * [3] no setting of unsupported bits
1313 * [4] doing anything requires privilege (go read about
1314 * the "sendmail capabilities bug")
1315 */
1316 )
1317 /* cannot change a locked bit */
1318 return -EPERM;
1319
1320 new = prepare_creds();
1321 if (!new)
1322 return -ENOMEM;
1323 new->securebits = arg2;
1324 return commit_creds(new);
1325
1326 case PR_GET_SECUREBITS:
1327 return old->securebits;
1328
1329 case PR_GET_KEEPCAPS:
1330 return !!issecure(SECURE_KEEP_CAPS);
1331
1332 case PR_SET_KEEPCAPS:
1333 if (arg2 > 1) /* Note, we rely on arg2 being unsigned here */
1334 return -EINVAL;
1335 if (issecure(SECURE_KEEP_CAPS_LOCKED))
1336 return -EPERM;
1337
1338 new = prepare_creds();
1339 if (!new)
1340 return -ENOMEM;
1341 if (arg2)
1342 new->securebits |= issecure_mask(SECURE_KEEP_CAPS);
1343 else
1344 new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
1345 return commit_creds(new);
1346
1347 case PR_CAP_AMBIENT:
1348 if (arg2 == PR_CAP_AMBIENT_CLEAR_ALL) {
1349 if (arg3 | arg4 | arg5)
1350 return -EINVAL;
1351
1352 new = prepare_creds();
1353 if (!new)
1354 return -ENOMEM;
1355 cap_clear(new->cap_ambient);
1356 return commit_creds(new);
1357 }
1358
1359 if (((!cap_valid(arg3)) | arg4 | arg5))
1360 return -EINVAL;
1361
1362 if (arg2 == PR_CAP_AMBIENT_IS_SET) {
1363 return !!cap_raised(current_cred()->cap_ambient, arg3);
1364 } else if (arg2 != PR_CAP_AMBIENT_RAISE &&
1365 arg2 != PR_CAP_AMBIENT_LOWER) {
1366 return -EINVAL;
1367 } else {
1368 if (arg2 == PR_CAP_AMBIENT_RAISE &&
1369 (!cap_raised(current_cred()->cap_permitted, arg3) ||
1370 !cap_raised(current_cred()->cap_inheritable,
1371 arg3) ||
1372 issecure(SECURE_NO_CAP_AMBIENT_RAISE)))
1373 return -EPERM;
1374
1375 new = prepare_creds();
1376 if (!new)
1377 return -ENOMEM;
1378 if (arg2 == PR_CAP_AMBIENT_RAISE)
1379 cap_raise(new->cap_ambient, arg3);
1380 else
1381 cap_lower(new->cap_ambient, arg3);
1382 return commit_creds(new);
1383 }
1384
1385 default:
1386 /* No functionality available - continue with default */
1387 return -ENOSYS;
1388 }
1389}
1390
1391/**
1392 * cap_vm_enough_memory - Determine whether a new virtual mapping is permitted
1393 * @mm: The VM space in which the new mapping is to be made
1394 * @pages: The size of the mapping
1395 *
1396 * Determine whether the allocation of a new virtual mapping by the current
1397 * task is permitted.
1398 *
1399 * Return: 0 if permission granted, negative error code if not.
1400 */
1401int cap_vm_enough_memory(struct mm_struct *mm, long pages)
1402{
1403 return cap_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
1404 CAP_OPT_NOAUDIT);
1405}
1406
1407/**
1408 * cap_mmap_addr - check if able to map given addr
1409 * @addr: address attempting to be mapped
1410 *
1411 * If the process is attempting to map memory below dac_mmap_min_addr they need
1412 * CAP_SYS_RAWIO. The other parameters to this function are unused by the
1413 * capability security module.
1414 *
1415 * Return: 0 if this mapping should be allowed or -EPERM if not.
1416 */
1417int cap_mmap_addr(unsigned long addr)
1418{
1419 int ret = 0;
1420
1421 if (addr < dac_mmap_min_addr) {
1422 ret = cap_capable(current_cred(), &init_user_ns, CAP_SYS_RAWIO,
1423 CAP_OPT_NONE);
1424 /* set PF_SUPERPRIV if it turns out we allow the low mmap */
1425 if (ret == 0)
1426 current->flags |= PF_SUPERPRIV;
1427 }
1428 return ret;
1429}
1430
1431int cap_mmap_file(struct file *file, unsigned long reqprot,
1432 unsigned long prot, unsigned long flags)
1433{
1434 return 0;
1435}
1436
1437#ifdef CONFIG_SECURITY
1438
1439static const struct lsm_id capability_lsmid = {
1440 .name = "capability",
1441 .id = LSM_ID_CAPABILITY,
1442};
1443
1444static struct security_hook_list capability_hooks[] __ro_after_init = {
1445 LSM_HOOK_INIT(capable, cap_capable),
1446 LSM_HOOK_INIT(settime, cap_settime),
1447 LSM_HOOK_INIT(ptrace_access_check, cap_ptrace_access_check),
1448 LSM_HOOK_INIT(ptrace_traceme, cap_ptrace_traceme),
1449 LSM_HOOK_INIT(capget, cap_capget),
1450 LSM_HOOK_INIT(capset, cap_capset),
1451 LSM_HOOK_INIT(bprm_creds_from_file, cap_bprm_creds_from_file),
1452 LSM_HOOK_INIT(inode_need_killpriv, cap_inode_need_killpriv),
1453 LSM_HOOK_INIT(inode_killpriv, cap_inode_killpriv),
1454 LSM_HOOK_INIT(inode_getsecurity, cap_inode_getsecurity),
1455 LSM_HOOK_INIT(mmap_addr, cap_mmap_addr),
1456 LSM_HOOK_INIT(mmap_file, cap_mmap_file),
1457 LSM_HOOK_INIT(task_fix_setuid, cap_task_fix_setuid),
1458 LSM_HOOK_INIT(task_prctl, cap_task_prctl),
1459 LSM_HOOK_INIT(task_setscheduler, cap_task_setscheduler),
1460 LSM_HOOK_INIT(task_setioprio, cap_task_setioprio),
1461 LSM_HOOK_INIT(task_setnice, cap_task_setnice),
1462 LSM_HOOK_INIT(vm_enough_memory, cap_vm_enough_memory),
1463};
1464
1465static int __init capability_init(void)
1466{
1467 security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks),
1468 &capability_lsmid);
1469 return 0;
1470}
1471
1472DEFINE_LSM(capability) = {
1473 .name = "capability",
1474 .order = LSM_ORDER_FIRST,
1475 .init = capability_init,
1476};
1477
1478#endif /* CONFIG_SECURITY */