2 * linux/kernel/capability.c
4 * Copyright (C) 1997 Andrew Main <zefram@fysh.org>
6 * Integrated into 2.1.97+, Andrew G. Morgan <morgan@kernel.org>
7 * 30 May 2002: Cleanup, Robert M. Love <rml@tech9.net>
10 #include <linux/audit.h>
11 #include <linux/capability.h>
13 #include <linux/module.h>
14 #include <linux/security.h>
15 #include <linux/syscalls.h>
16 #include <linux/pid_namespace.h>
17 #include <asm/uaccess.h>
20 * This lock protects task->cap_* for all tasks including current.
21 * Locking rule: acquire this prior to tasklist_lock.
23 static DEFINE_SPINLOCK(task_capability_lock
);
26 * Leveraged for setting/resetting capabilities
29 const kernel_cap_t __cap_empty_set
= CAP_EMPTY_SET
;
30 const kernel_cap_t __cap_full_set
= CAP_FULL_SET
;
31 const kernel_cap_t __cap_init_eff_set
= CAP_INIT_EFF_SET
;
33 EXPORT_SYMBOL(__cap_empty_set
);
34 EXPORT_SYMBOL(__cap_full_set
);
35 EXPORT_SYMBOL(__cap_init_eff_set
);
37 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
38 int file_caps_enabled
= 1;
40 static int __init
file_caps_disable(char *str
)
42 file_caps_enabled
= 0;
45 __setup("no_file_caps", file_caps_disable
);
49 * More recent versions of libcap are available from:
51 * http://www.kernel.org/pub/linux/libs/security/linux-privs/
54 static void warn_legacy_capability_use(void)
58 char name
[sizeof(current
->comm
)];
60 printk(KERN_INFO
"warning: `%s' uses 32-bit capabilities"
61 " (legacy support in use)\n",
62 get_task_comm(name
, current
));
68 * Version 2 capabilities worked fine, but the linux/capability.h file
69 * that accompanied their introduction encouraged their use without
70 * the necessary user-space source code changes. As such, we have
71 * created a version 3 with equivalent functionality to version 2, but
72 * with a header change to protect legacy source code from using
73 * version 2 when it wanted to use version 1. If your system has code
74 * that trips the following warning, it is using version 2 specific
75 * capabilities and may be doing so insecurely.
77 * The remedy is to either upgrade your version of libcap (to 2.10+,
78 * if the application is linked against it), or recompile your
79 * application with modern kernel headers and this warning will go
83 static void warn_deprecated_v2(void)
88 char name
[sizeof(current
->comm
)];
90 printk(KERN_INFO
"warning: `%s' uses deprecated v2"
91 " capabilities in a way that may be insecure.\n",
92 get_task_comm(name
, current
));
98 * Version check. Return the number of u32s in each capability flag
99 * array, or a negative value on error.
101 static int cap_validate_magic(cap_user_header_t header
, unsigned *tocopy
)
105 if (get_user(version
, &header
->version
))
109 case _LINUX_CAPABILITY_VERSION_1
:
110 warn_legacy_capability_use();
111 *tocopy
= _LINUX_CAPABILITY_U32S_1
;
113 case _LINUX_CAPABILITY_VERSION_2
:
114 warn_deprecated_v2();
116 * fall through - v3 is otherwise equivalent to v2.
118 case _LINUX_CAPABILITY_VERSION_3
:
119 *tocopy
= _LINUX_CAPABILITY_U32S_3
;
122 if (put_user((u32
)_KERNEL_CAPABILITY_VERSION
, &header
->version
))
131 * If we have configured with filesystem capability support, then the
132 * only thing that can change the capabilities of the current process
133 * is the current process. As such, we can't be in this code at the
134 * same time as we are in the process of setting capabilities in this
135 * process. The net result is that we can limit our use of locks to
136 * when we are reading the caps of another process.
138 static inline int cap_get_target_pid(pid_t pid
, kernel_cap_t
*pEp
,
139 kernel_cap_t
*pIp
, kernel_cap_t
*pPp
)
143 if (pid
&& (pid
!= task_pid_vnr(current
))) {
144 struct task_struct
*target
;
146 spin_lock(&task_capability_lock
);
147 read_lock(&tasklist_lock
);
149 target
= find_task_by_vpid(pid
);
153 ret
= security_capget(target
, pEp
, pIp
, pPp
);
155 read_unlock(&tasklist_lock
);
156 spin_unlock(&task_capability_lock
);
158 ret
= security_capget(current
, pEp
, pIp
, pPp
);
164 * Atomically modify the effective capabilities returning the original
165 * value. No permission check is performed here - it is assumed that the
166 * caller is permitted to set the desired effective capabilities.
168 kernel_cap_t
cap_set_effective(const kernel_cap_t pE_new
)
172 spin_lock(&task_capability_lock
);
174 pE_old
= current
->cred
->cap_effective
;
175 current
->cred
->cap_effective
= pE_new
;
177 spin_unlock(&task_capability_lock
);
182 EXPORT_SYMBOL(cap_set_effective
);
185 * sys_capget - get the capabilities of a given process.
186 * @header: pointer to struct that contains capability version and
188 * @dataptr: pointer to struct that contains the effective, permitted,
189 * and inheritable capabilities that are returned
191 * Returns 0 on success and < 0 on error.
193 asmlinkage
long sys_capget(cap_user_header_t header
, cap_user_data_t dataptr
)
198 kernel_cap_t pE
, pI
, pP
;
200 ret
= cap_validate_magic(header
, &tocopy
);
204 if (get_user(pid
, &header
->pid
))
210 ret
= cap_get_target_pid(pid
, &pE
, &pI
, &pP
);
213 struct __user_cap_data_struct kdata
[_KERNEL_CAPABILITY_U32S
];
216 for (i
= 0; i
< tocopy
; i
++) {
217 kdata
[i
].effective
= pE
.cap
[i
];
218 kdata
[i
].permitted
= pP
.cap
[i
];
219 kdata
[i
].inheritable
= pI
.cap
[i
];
223 * Note, in the case, tocopy < _KERNEL_CAPABILITY_U32S,
224 * we silently drop the upper capabilities here. This
225 * has the effect of making older libcap
226 * implementations implicitly drop upper capability
227 * bits when they perform a: capget/modify/capset
230 * This behavior is considered fail-safe
231 * behavior. Upgrading the application to a newer
232 * version of libcap will enable access to the newer
235 * An alternative would be to return an error here
236 * (-ERANGE), but that causes legacy applications to
237 * unexpectidly fail; the capget/modify/capset aborts
238 * before modification is attempted and the application
241 if (copy_to_user(dataptr
, kdata
, tocopy
242 * sizeof(struct __user_cap_data_struct
))) {
251 * sys_capset - set capabilities for a process or (*) a group of processes
252 * @header: pointer to struct that contains capability version and
254 * @data: pointer to struct that contains the effective, permitted,
255 * and inheritable capabilities
257 * Set capabilities for the current process only. The ability to any other
258 * process(es) has been deprecated and removed.
260 * The restrictions on setting capabilities are specified as:
262 * I: any raised capabilities must be a subset of the old permitted
263 * P: any raised capabilities must be a subset of the old permitted
264 * E: must be set to a subset of new permitted
266 * Returns 0 on success and < 0 on error.
268 asmlinkage
long sys_capset(cap_user_header_t header
, const cap_user_data_t data
)
270 struct __user_cap_data_struct kdata
[_KERNEL_CAPABILITY_U32S
];
272 kernel_cap_t inheritable
, permitted
, effective
;
276 ret
= cap_validate_magic(header
, &tocopy
);
280 if (get_user(pid
, &header
->pid
))
283 /* may only affect current now */
284 if (pid
!= 0 && pid
!= task_pid_vnr(current
))
287 if (copy_from_user(&kdata
, data
, tocopy
288 * sizeof(struct __user_cap_data_struct
)))
291 for (i
= 0; i
< tocopy
; i
++) {
292 effective
.cap
[i
] = kdata
[i
].effective
;
293 permitted
.cap
[i
] = kdata
[i
].permitted
;
294 inheritable
.cap
[i
] = kdata
[i
].inheritable
;
296 while (i
< _KERNEL_CAPABILITY_U32S
) {
297 effective
.cap
[i
] = 0;
298 permitted
.cap
[i
] = 0;
299 inheritable
.cap
[i
] = 0;
303 ret
= audit_log_capset(pid
, &effective
, &inheritable
, &permitted
);
307 /* This lock is required even when filesystem capability support is
308 * configured - it protects the sys_capget() call from returning
309 * incorrect data in the case that the targeted process is not the
312 spin_lock(&task_capability_lock
);
314 ret
= security_capset_check(&effective
, &inheritable
, &permitted
);
315 /* Having verified that the proposed changes are legal, we now put them
319 security_capset_set(&effective
, &inheritable
, &permitted
);
320 spin_unlock(&task_capability_lock
);
325 * capable - Determine if the current task has a superior capability in effect
326 * @cap: The capability to be tested for
328 * Return true if the current task has the given superior capability currently
329 * available for use, false if not.
331 * This sets PF_SUPERPRIV on the task if the capability is available on the
332 * assumption that it's about to be used.
336 if (unlikely(!cap_valid(cap
))) {
337 printk(KERN_CRIT
"capable() called with invalid cap=%u\n", cap
);
341 if (has_capability(current
, cap
)) {
342 current
->flags
|= PF_SUPERPRIV
;
347 EXPORT_SYMBOL(capable
);