kernel/capability.c

   1 /*
   2  * linux/kernel/capability.c
   3  *
   4  * Copyright (C) 1997  Andrew Main <zefram@fysh.org>
   5  *
   6  * Integrated into 2.1.97+,  Andrew G. Morgan <morgan@kernel.org>
   7  * 30 May 2002: Cleanup, Robert M. Love <rml@tech9.net>
   8  */
   9
  10 #include <linux/capability.h>
  11 #include <linux/mm.h>
  12 #include <linux/module.h>
  13 #include <linux/security.h>
  14 #include <linux/syscalls.h>
  15 #include <linux/pid_namespace.h>
  16 #include <asm/uaccess.h>
  17
  18 /*
  19  * This lock protects task->cap_* for all tasks including current.
  20  * Locking rule: acquire this prior to tasklist_lock.
  21  */
  22 static DEFINE_SPINLOCK(task_capability_lock);
  23
  24 /*
  25  * Leveraged for setting/resetting capabilities
  26  */
  27
  28 const kernel_cap_t __cap_empty_set = CAP_EMPTY_SET;
  29 const kernel_cap_t __cap_full_set = CAP_FULL_SET;
  30 const kernel_cap_t __cap_init_eff_set = CAP_INIT_EFF_SET;
  31
  32 EXPORT_SYMBOL(__cap_empty_set);
  33 EXPORT_SYMBOL(__cap_full_set);
  34 EXPORT_SYMBOL(__cap_init_eff_set);
  35
  36 /*
  37  * More recent versions of libcap are available from:
  38  *
  39  *   http://www.kernel.org/pub/linux/libs/security/linux-privs/
  40  */
  41
  42 static void warn_legacy_capability_use(void)
  43 {
  44         static int warned;
  45         if (!warned) {
  46                 char name[sizeof(current->comm)];
  47
  48                 printk(KERN_INFO "warning: `%s' uses 32-bit capabilities"
  49                        " (legacy support in use)\n",
  50                        get_task_comm(name, current));
  51                 warned = 1;
  52         }
  53 }
  54
  55 /*
  56  * Version 2 capabilities worked fine, but the linux/capability.h file
  57  * that accompanied their introduction encouraged their use without
  58  * the necessary user-space source code changes. As such, we have
  59  * created a version 3 with equivalent functionality to version 2, but
  60  * with a header change to protect legacy source code from using
  61  * version 2 when it wanted to use version 1. If your system has code
  62  * that trips the following warning, it is using version 2 specific
  63  * capabilities and may be doing so insecurely.
  64  *
  65  * The remedy is to either upgrade your version of libcap (to 2.10+,
  66  * if the application is linked against it), or recompile your
  67  * application with modern kernel headers and this warning will go
  68  * away.
  69  */
  70
  71 static void warn_deprecated_v2(void)
  72 {
  73         static int warned;
  74
  75         if (!warned) {
  76                 char name[sizeof(current->comm)];
  77
  78                 printk(KERN_INFO "warning: `%s' uses deprecated v2"
  79                        " capabilities in a way that may be insecure.\n",
  80                        get_task_comm(name, current));
  81                 warned = 1;
  82         }
  83 }
  84
  85 /*
  86  * Version check. Return the number of u32s in each capability flag
  87  * array, or a negative value on error.
  88  */
  89 static int cap_validate_magic(cap_user_header_t header, unsigned *tocopy)
  90 {
  91         __u32 version;
  92
  93         if (get_user(version, &header->version))
  94                 return -EFAULT;
  95
  96         switch (version) {
  97         case _LINUX_CAPABILITY_VERSION_1:
  98                 warn_legacy_capability_use();
  99                 *tocopy = _LINUX_CAPABILITY_U32S_1;
 100                 break;
 101         case _LINUX_CAPABILITY_VERSION_2:
 102                 warn_deprecated_v2();
 103                 /*
 104                  * fall through - v3 is otherwise equivalent to v2.
 105                  */
 106         case _LINUX_CAPABILITY_VERSION_3:
 107                 *tocopy = _LINUX_CAPABILITY_U32S_3;
 108                 break;
 109         default:
 110                 if (put_user((u32)_KERNEL_CAPABILITY_VERSION, &header->version))
 111                         return -EFAULT;
 112                 return -EINVAL;
 113         }
 114
 115         return 0;
 116 }
 117
 118 /*
 119  * For sys_getproccap() and sys_setproccap(), any of the three
 120  * capability set pointers may be NULL -- indicating that that set is
 121  * uninteresting and/or not to be changed.
 122  */
 123
 124 /*
 125  * Atomically modify the effective capabilities returning the original
 126  * value. No permission check is performed here - it is assumed that the
 127  * caller is permitted to set the desired effective capabilities.
 128  */
 129 kernel_cap_t cap_set_effective(const kernel_cap_t pE_new)
 130 {
 131         kernel_cap_t pE_old;
 132
 133         spin_lock(&task_capability_lock);
 134
 135         pE_old = current->cap_effective;
 136         current->cap_effective = pE_new;
 137
 138         spin_unlock(&task_capability_lock);
 139
 140         return pE_old;
 141 }
 142
 143 EXPORT_SYMBOL(cap_set_effective);
 144
 145 /**
 146  * sys_capget - get the capabilities of a given process.
 147  * @header: pointer to struct that contains capability version and
 148  *      target pid data
 149  * @dataptr: pointer to struct that contains the effective, permitted,
 150  *      and inheritable capabilities that are returned
 151  *
 152  * Returns 0 on success and < 0 on error.
 153  */
 154 asmlinkage long sys_capget(cap_user_header_t header, cap_user_data_t dataptr)
 155 {
 156         int ret = 0;
 157         pid_t pid;
 158         struct task_struct *target;
 159         unsigned tocopy;
 160         kernel_cap_t pE, pI, pP;
 161
 162         ret = cap_validate_magic(header, &tocopy);
 163         if (ret != 0)
 164                 return ret;
 165
 166         if (get_user(pid, &header->pid))
 167                 return -EFAULT;
 168
 169         if (pid < 0)
 170                 return -EINVAL;
 171
 172         spin_lock(&task_capability_lock);
 173         read_lock(&tasklist_lock);
 174
 175         if (pid && pid != task_pid_vnr(current)) {
 176                 target = find_task_by_vpid(pid);
 177                 if (!target) {
 178                         ret = -ESRCH;
 179                         goto out;
 180                 }
 181         } else
 182                 target = current;
 183
 184         ret = security_capget(target, &pE, &pI, &pP);
 185
 186 out:
 187         read_unlock(&tasklist_lock);
 188         spin_unlock(&task_capability_lock);
 189
 190         if (!ret) {
 191                 struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S];
 192                 unsigned i;
 193
 194                 for (i = 0; i < tocopy; i++) {
 195                         kdata[i].effective = pE.cap[i];
 196                         kdata[i].permitted = pP.cap[i];
 197                         kdata[i].inheritable = pI.cap[i];
 198                 }
 199
 200                 /*
 201                  * Note, in the case, tocopy < _KERNEL_CAPABILITY_U32S,
 202                  * we silently drop the upper capabilities here. This
 203                  * has the effect of making older libcap
 204                  * implementations implicitly drop upper capability
 205                  * bits when they perform a: capget/modify/capset
 206                  * sequence.
 207                  *
 208                  * This behavior is considered fail-safe
 209                  * behavior. Upgrading the application to a newer
 210                  * version of libcap will enable access to the newer
 211                  * capabilities.
 212                  *
 213                  * An alternative would be to return an error here
 214                  * (-ERANGE), but that causes legacy applications to
 215                  * unexpectidly fail; the capget/modify/capset aborts
 216                  * before modification is attempted and the application
 217                  * fails.
 218                  */
 219
 220                 if (copy_to_user(dataptr, kdata, tocopy
 221                                  * sizeof(struct __user_cap_data_struct))) {
 222                         return -EFAULT;
 223                 }
 224         }
 225
 226         return ret;
 227 }
 228
 229 /*
 230  * cap_set_pg - set capabilities for all processes in a given process
 231  * group.  We call this holding task_capability_lock and tasklist_lock.
 232  */
 233 static inline int cap_set_pg(int pgrp_nr, kernel_cap_t *effective,
 234                               kernel_cap_t *inheritable,
 235                               kernel_cap_t *permitted)
 236 {
 237         struct task_struct *g, *target;
 238         int ret = -EPERM;
 239         int found = 0;
 240         struct pid *pgrp;
 241
 242         pgrp = find_vpid(pgrp_nr);
 243         do_each_pid_task(pgrp, PIDTYPE_PGID, g) {
 244                 target = g;
 245                 while_each_thread(g, target) {
 246                         if (!security_capset_check(target, effective,
 247                                                         inheritable,
 248                                                         permitted)) {
 249                                 security_capset_set(target, effective,
 250                                                         inheritable,
 251                                                         permitted);
 252                                 ret = 0;
 253                         }
 254                         found = 1;
 255                 }
 256         } while_each_pid_task(pgrp, PIDTYPE_PGID, g);
 257
 258         if (!found)
 259                 ret = 0;
 260         return ret;
 261 }
 262
 263 /*
 264  * cap_set_all - set capabilities for all processes other than init
 265  * and self.  We call this holding task_capability_lock and tasklist_lock.
 266  */
 267 static inline int cap_set_all(kernel_cap_t *effective,
 268                                kernel_cap_t *inheritable,
 269                                kernel_cap_t *permitted)
 270 {
 271      struct task_struct *g, *target;
 272      int ret = -EPERM;
 273      int found = 0;
 274
 275      do_each_thread(g, target) {
 276              if (target == current || is_container_init(target->group_leader))
 277                      continue;
 278              found = 1;
 279              if (security_capset_check(target, effective, inheritable,
 280                                                 permitted))
 281                      continue;
 282              ret = 0;
 283              security_capset_set(target, effective, inheritable, permitted);
 284      } while_each_thread(g, target);
 285
 286      if (!found)
 287              ret = 0;
 288      return ret;
 289 }
 290
 291 /**
 292  * sys_capset - set capabilities for a process or a group of processes
 293  * @header: pointer to struct that contains capability version and
 294  *      target pid data
 295  * @data: pointer to struct that contains the effective, permitted,
 296  *      and inheritable capabilities
 297  *
 298  * Set capabilities for a given process, all processes, or all
 299  * processes in a given process group.
 300  *
 301  * The restrictions on setting capabilities are specified as:
 302  *
 303  * [pid is for the 'target' task.  'current' is the calling task.]
 304  *
 305  * I: any raised capabilities must be a subset of the (old current) permitted
 306  * P: any raised capabilities must be a subset of the (old current) permitted
 307  * E: must be set to a subset of (new target) permitted
 308  *
 309  * Returns 0 on success and < 0 on error.
 310  */
 311 asmlinkage long sys_capset(cap_user_header_t header, const cap_user_data_t data)
 312 {
 313         struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S];
 314         unsigned i, tocopy;
 315         kernel_cap_t inheritable, permitted, effective;
 316         struct task_struct *target;
 317         int ret;
 318         pid_t pid;
 319
 320         ret = cap_validate_magic(header, &tocopy);
 321         if (ret != 0)
 322                 return ret;
 323
 324         if (get_user(pid, &header->pid))
 325                 return -EFAULT;
 326
 327         if (pid && pid != task_pid_vnr(current) && !capable(CAP_SETPCAP))
 328                 return -EPERM;
 329
 330         if (copy_from_user(&kdata, data, tocopy
 331                            * sizeof(struct __user_cap_data_struct))) {
 332                 return -EFAULT;
 333         }
 334
 335         for (i = 0; i < tocopy; i++) {
 336                 effective.cap[i] = kdata[i].effective;
 337                 permitted.cap[i] = kdata[i].permitted;
 338                 inheritable.cap[i] = kdata[i].inheritable;
 339         }
 340         while (i < _KERNEL_CAPABILITY_U32S) {
 341                 effective.cap[i] = 0;
 342                 permitted.cap[i] = 0;
 343                 inheritable.cap[i] = 0;
 344                 i++;
 345         }
 346
 347         spin_lock(&task_capability_lock);
 348         read_lock(&tasklist_lock);
 349
 350         if (pid > 0 && pid != task_pid_vnr(current)) {
 351                 target = find_task_by_vpid(pid);
 352                 if (!target) {
 353                         ret = -ESRCH;
 354                         goto out;
 355                 }
 356         } else
 357                 target = current;
 358
 359         ret = 0;
 360
 361         /* having verified that the proposed changes are legal,
 362            we now put them into effect. */
 363         if (pid < 0) {
 364                 if (pid == -1)  /* all procs other than current and init */
 365                         ret = cap_set_all(&effective, &inheritable, &permitted);
 366
 367                 else            /* all procs in process group */
 368                         ret = cap_set_pg(-pid, &effective, &inheritable,
 369                                          &permitted);
 370         } else {
 371                 ret = security_capset_check(target, &effective, &inheritable,
 372                                             &permitted);
 373                 if (!ret)
 374                         security_capset_set(target, &effective, &inheritable,
 375                                             &permitted);
 376         }
 377
 378 out:
 379         read_unlock(&tasklist_lock);
 380         spin_unlock(&task_capability_lock);
 381
 382         return ret;
 383 }
 384
 385 int __capable(struct task_struct *t, int cap)
 386 {
 387         if (security_capable(t, cap) == 0) {
 388                 t->flags |= PF_SUPERPRIV;
 389                 return 1;
 390         }
 391         return 0;
 392 }
 393
 394 int capable(int cap)
 395 {
 396         return __capable(current, cap);
 397 }
 398 EXPORT_SYMBOL(capable);