1 /* Common capabilities, needed by capability.o and root_plug.o
3 * This program is free software; you can redistribute it and/or modify
4 * it under the terms of the GNU General Public License as published by
5 * the Free Software Foundation; either version 2 of the License, or
6 * (at your option) any later version.
10 #include <linux/config.h>
11 #include <linux/module.h>
12 #include <linux/init.h>
13 #include <linux/kernel.h>
14 #include <linux/security.h>
15 #include <linux/file.h>
17 #include <linux/mman.h>
18 #include <linux/pagemap.h>
19 #include <linux/swap.h>
20 #include <linux/smp_lock.h>
21 #include <linux/skbuff.h>
22 #include <linux/netlink.h>
23 #include <linux/ptrace.h>
25 int cap_capable (struct task_struct
*tsk
, int cap
)
27 /* Derived from include/linux/sched.h:capable. */
28 if (cap_raised (tsk
->cap_effective
, cap
))
34 int cap_ptrace (struct task_struct
*parent
, struct task_struct
*child
)
36 /* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */
37 if (!cap_issubset (child
->cap_permitted
, current
->cap_permitted
) &&
38 !capable (CAP_SYS_PTRACE
))
44 int cap_capget (struct task_struct
*target
, kernel_cap_t
*effective
,
45 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
47 /* Derived from kernel/capability.c:sys_capget. */
48 *effective
= cap_t (target
->cap_effective
);
49 *inheritable
= cap_t (target
->cap_inheritable
);
50 *permitted
= cap_t (target
->cap_permitted
);
54 int cap_capset_check (struct task_struct
*target
, kernel_cap_t
*effective
,
55 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
57 /* Derived from kernel/capability.c:sys_capset. */
58 /* verify restrictions on target's new Inheritable set */
59 if (!cap_issubset (*inheritable
,
60 cap_combine (target
->cap_inheritable
,
61 current
->cap_permitted
))) {
65 /* verify restrictions on target's new Permitted set */
66 if (!cap_issubset (*permitted
,
67 cap_combine (target
->cap_permitted
,
68 current
->cap_permitted
))) {
72 /* verify the _new_Effective_ is a subset of the _new_Permitted_ */
73 if (!cap_issubset (*effective
, *permitted
)) {
80 void cap_capset_set (struct task_struct
*target
, kernel_cap_t
*effective
,
81 kernel_cap_t
*inheritable
, kernel_cap_t
*permitted
)
83 target
->cap_effective
= *effective
;
84 target
->cap_inheritable
= *inheritable
;
85 target
->cap_permitted
= *permitted
;
88 int cap_bprm_set_security (struct linux_binprm
*bprm
)
90 /* Copied from fs/exec.c:prepare_binprm. */
92 /* We don't have VFS support for capabilities yet */
93 cap_clear (bprm
->cap_inheritable
);
94 cap_clear (bprm
->cap_permitted
);
95 cap_clear (bprm
->cap_effective
);
97 /* To support inheritance of root-permissions and suid-root
98 * executables under compatibility mode, we raise all three
99 * capability sets for the file.
101 * If only the real uid is 0, we only raise the inheritable
102 * and permitted sets of the executable file.
105 if (!issecure (SECURE_NOROOT
)) {
106 if (bprm
->e_uid
== 0 || current
->uid
== 0) {
107 cap_set_full (bprm
->cap_inheritable
);
108 cap_set_full (bprm
->cap_permitted
);
110 if (bprm
->e_uid
== 0)
111 cap_set_full (bprm
->cap_effective
);
116 /* Copied from fs/exec.c */
117 static inline int must_not_trace_exec (struct task_struct
*p
)
119 return (p
->ptrace
& PT_PTRACED
) && !(p
->ptrace
& PT_PTRACE_CAP
);
122 void cap_bprm_compute_creds (struct linux_binprm
*bprm
)
124 /* Derived from fs/exec.c:compute_creds. */
125 kernel_cap_t new_permitted
, working
;
127 new_permitted
= cap_intersect (bprm
->cap_permitted
, cap_bset
);
128 working
= cap_intersect (bprm
->cap_inheritable
,
129 current
->cap_inheritable
);
130 new_permitted
= cap_combine (new_permitted
, working
);
133 if (!cap_issubset (new_permitted
, current
->cap_permitted
)) {
134 current
->mm
->dumpable
= 0;
136 if (must_not_trace_exec (current
)
137 || atomic_read (¤t
->fs
->count
) > 1
138 || atomic_read (¤t
->files
->count
) > 1
139 || atomic_read (¤t
->sighand
->count
) > 1) {
140 if (!capable (CAP_SETPCAP
)) {
141 new_permitted
= cap_intersect (new_permitted
,
148 /* For init, we want to retain the capabilities set
149 * in the init_task struct. Thus we skip the usual
150 * capability rules */
151 if (current
->pid
!= 1) {
152 current
->cap_permitted
= new_permitted
;
153 current
->cap_effective
=
154 cap_intersect (new_permitted
, bprm
->cap_effective
);
157 /* AUD: Audit candidate if current->cap_effective is set */
158 task_unlock(current
);
160 current
->keep_capabilities
= 0;
163 int cap_bprm_secureexec (struct linux_binprm
*bprm
)
165 /* If/when this module is enhanced to incorporate capability
166 bits on files, the test below should be extended to also perform a
167 test between the old and new capability sets. For now,
168 it simply preserves the legacy decision algorithm used by
170 return (current
->euid
!= current
->uid
||
171 current
->egid
!= current
->gid
);
174 /* moved from kernel/sys.c. */
176 * cap_emulate_setxuid() fixes the effective / permitted capabilities of
177 * a process after a call to setuid, setreuid, or setresuid.
179 * 1) When set*uiding _from_ one of {r,e,s}uid == 0 _to_ all of
180 * {r,e,s}uid != 0, the permitted and effective capabilities are
183 * 2) When set*uiding _from_ euid == 0 _to_ euid != 0, the effective
184 * capabilities of the process are cleared.
186 * 3) When set*uiding _from_ euid != 0 _to_ euid == 0, the effective
187 * capabilities are set to the permitted capabilities.
189 * fsuid is handled elsewhere. fsuid == 0 and {r,e,s}uid!= 0 should
194 * cevans - New behaviour, Oct '99
195 * A process may, via prctl(), elect to keep its capabilities when it
196 * calls setuid() and switches away from uid==0. Both permitted and
197 * effective sets will be retained.
198 * Without this change, it was impossible for a daemon to drop only some
199 * of its privilege. The call to setuid(!=0) would drop all privileges!
200 * Keeping uid 0 is not an option because uid 0 owns too many vital
202 * Thanks to Olaf Kirch and Peter Benie for spotting this.
204 static inline void cap_emulate_setxuid (int old_ruid
, int old_euid
,
207 if ((old_ruid
== 0 || old_euid
== 0 || old_suid
== 0) &&
208 (current
->uid
!= 0 && current
->euid
!= 0 && current
->suid
!= 0) &&
209 !current
->keep_capabilities
) {
210 cap_clear (current
->cap_permitted
);
211 cap_clear (current
->cap_effective
);
213 if (old_euid
== 0 && current
->euid
!= 0) {
214 cap_clear (current
->cap_effective
);
216 if (old_euid
!= 0 && current
->euid
== 0) {
217 current
->cap_effective
= current
->cap_permitted
;
221 int cap_task_post_setuid (uid_t old_ruid
, uid_t old_euid
, uid_t old_suid
,
228 /* Copied from kernel/sys.c:setreuid/setuid/setresuid. */
229 if (!issecure (SECURE_NO_SETUID_FIXUP
)) {
230 cap_emulate_setxuid (old_ruid
, old_euid
, old_suid
);
235 uid_t old_fsuid
= old_ruid
;
237 /* Copied from kernel/sys.c:setfsuid. */
240 * FIXME - is fsuser used for all CAP_FS_MASK capabilities?
241 * if not, we might be a bit too harsh here.
244 if (!issecure (SECURE_NO_SETUID_FIXUP
)) {
245 if (old_fsuid
== 0 && current
->fsuid
!= 0) {
246 cap_t (current
->cap_effective
) &=
249 if (old_fsuid
!= 0 && current
->fsuid
== 0) {
250 cap_t (current
->cap_effective
) |=
251 (cap_t (current
->cap_permitted
) &
264 void cap_task_reparent_to_init (struct task_struct
*p
)
266 p
->cap_effective
= CAP_INIT_EFF_SET
;
267 p
->cap_inheritable
= CAP_INIT_INH_SET
;
268 p
->cap_permitted
= CAP_FULL_SET
;
269 p
->keep_capabilities
= 0;
273 int cap_syslog (int type
)
275 if ((type
!= 3) && !capable(CAP_SYS_ADMIN
))
281 * Check that a process has enough memory to allocate a new virtual
282 * mapping. 0 means there is enough memory for the allocation to
283 * succeed and -ENOMEM implies there is not.
285 * We currently support three overcommit policies, which are set via the
286 * vm.overcommit_memory sysctl. See Documentation/vm/overcommit-acounting
288 * Strict overcommit modes added 2002 Feb 26 by Alan Cox.
289 * Additional code 2002 Jul 20 by Robert Love.
291 int cap_vm_enough_memory(long pages
)
293 unsigned long free
, allowed
;
295 vm_acct_memory(pages
);
298 * Sometimes we want to use more memory than we have
300 if (sysctl_overcommit_memory
== 1)
303 if (sysctl_overcommit_memory
== 0) {
304 free
= get_page_cache_size();
305 free
+= nr_free_pages();
306 free
+= nr_swap_pages
;
309 * Any slabs which are created with the
310 * SLAB_RECLAIM_ACCOUNT flag claim to have contents
311 * which are reclaimable, under pressure. The dentry
312 * cache and most inode caches should fall into this
314 free
+= atomic_read(&slab_reclaim_pages
);
317 * Leave the last 3% for root
319 if (!capable(CAP_SYS_ADMIN
))
324 vm_unacct_memory(pages
);
328 allowed
= totalram_pages
* sysctl_overcommit_ratio
/ 100;
329 allowed
+= total_swap_pages
;
331 if (atomic_read(&vm_committed_space
) < allowed
)
334 vm_unacct_memory(pages
);
339 EXPORT_SYMBOL(cap_capable
);
340 EXPORT_SYMBOL(cap_ptrace
);
341 EXPORT_SYMBOL(cap_capget
);
342 EXPORT_SYMBOL(cap_capset_check
);
343 EXPORT_SYMBOL(cap_capset_set
);
344 EXPORT_SYMBOL(cap_bprm_set_security
);
345 EXPORT_SYMBOL(cap_bprm_compute_creds
);
346 EXPORT_SYMBOL(cap_bprm_secureexec
);
347 EXPORT_SYMBOL(cap_task_post_setuid
);
348 EXPORT_SYMBOL(cap_task_reparent_to_init
);
349 EXPORT_SYMBOL(cap_syslog
);
350 EXPORT_SYMBOL(cap_vm_enough_memory
);
352 MODULE_DESCRIPTION("Standard Linux Common Capabilities Security Module");
353 MODULE_LICENSE("GPL");