1
2
3
4
5
6
7
8
9
10#include <linux/capability.h>
11#include <linux/audit.h>
12#include <linux/module.h>
13#include <linux/init.h>
14#include <linux/kernel.h>
15#include <linux/lsm_hooks.h>
16#include <linux/file.h>
17#include <linux/mm.h>
18#include <linux/mman.h>
19#include <linux/pagemap.h>
20#include <linux/swap.h>
21#include <linux/skbuff.h>
22#include <linux/netlink.h>
23#include <linux/ptrace.h>
24#include <linux/xattr.h>
25#include <linux/hugetlb.h>
26#include <linux/mount.h>
27#include <linux/sched.h>
28#include <linux/prctl.h>
29#include <linux/securebits.h>
30#include <linux/user_namespace.h>
31#include <linux/binfmts.h>
32#include <linux/personality.h>
33
34
35
36
37
38
39
40
41
42
43
44
45static void warn_setuid_and_fcaps_mixed(const char *fname)
46{
47 static int warned;
48 if (!warned) {
49 printk(KERN_INFO "warning: `%s' has both setuid-root and"
50 " effective capabilities. Therefore not raising all"
51 " capabilities.\n", fname);
52 warned = 1;
53 }
54}
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
72 int cap, int audit)
73{
74 struct user_namespace *ns = targ_ns;
75
76
77
78
79
80 for (;;) {
81
82 if (ns == cred->user_ns)
83 return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
84
85
86
87
88
89 if (ns->level <= cred->user_ns->level)
90 return -EPERM;
91
92
93
94
95
96 if ((ns->parent == cred->user_ns) && uid_eq(ns->owner, cred->euid))
97 return 0;
98
99
100
101
102
103 ns = ns->parent;
104 }
105
106
107}
108
109
110
111
112
113
114
115
116
117int cap_settime(const struct timespec64 *ts, const struct timezone *tz)
118{
119 if (!capable(CAP_SYS_TIME))
120 return -EPERM;
121 return 0;
122}
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139int cap_ptrace_access_check(struct task_struct *child, unsigned int mode)
140{
141 int ret = 0;
142 const struct cred *cred, *child_cred;
143 const kernel_cap_t *caller_caps;
144
145 rcu_read_lock();
146 cred = current_cred();
147 child_cred = __task_cred(child);
148 if (mode & PTRACE_MODE_FSCREDS)
149 caller_caps = &cred->cap_effective;
150 else
151 caller_caps = &cred->cap_permitted;
152 if (cred->user_ns == child_cred->user_ns &&
153 cap_issubset(child_cred->cap_permitted, *caller_caps))
154 goto out;
155 if (ns_capable(child_cred->user_ns, CAP_SYS_PTRACE))
156 goto out;
157 ret = -EPERM;
158out:
159 rcu_read_unlock();
160 return ret;
161}
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176int cap_ptrace_traceme(struct task_struct *parent)
177{
178 int ret = 0;
179 const struct cred *cred, *child_cred;
180
181 rcu_read_lock();
182 cred = __task_cred(parent);
183 child_cred = current_cred();
184 if (cred->user_ns == child_cred->user_ns &&
185 cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
186 goto out;
187 if (has_ns_capability(parent, child_cred->user_ns, CAP_SYS_PTRACE))
188 goto out;
189 ret = -EPERM;
190out:
191 rcu_read_unlock();
192 return ret;
193}
194
195
196
197
198
199
200
201
202
203
204
205int cap_capget(struct task_struct *target, kernel_cap_t *effective,
206 kernel_cap_t *inheritable, kernel_cap_t *permitted)
207{
208 const struct cred *cred;
209
210
211 rcu_read_lock();
212 cred = __task_cred(target);
213 *effective = cred->cap_effective;
214 *inheritable = cred->cap_inheritable;
215 *permitted = cred->cap_permitted;
216 rcu_read_unlock();
217 return 0;
218}
219
220
221
222
223
224static inline int cap_inh_is_capped(void)
225{
226
227
228
229
230 if (cap_capable(current_cred(), current_cred()->user_ns,
231 CAP_SETPCAP, SECURITY_CAP_AUDIT) == 0)
232 return 0;
233 return 1;
234}
235
236
237
238
239
240
241
242
243
244
245
246
247
248int cap_capset(struct cred *new,
249 const struct cred *old,
250 const kernel_cap_t *effective,
251 const kernel_cap_t *inheritable,
252 const kernel_cap_t *permitted)
253{
254 if (cap_inh_is_capped() &&
255 !cap_issubset(*inheritable,
256 cap_combine(old->cap_inheritable,
257 old->cap_permitted)))
258
259 return -EPERM;
260
261 if (!cap_issubset(*inheritable,
262 cap_combine(old->cap_inheritable,
263 old->cap_bset)))
264
265 return -EPERM;
266
267
268 if (!cap_issubset(*permitted, old->cap_permitted))
269 return -EPERM;
270
271
272 if (!cap_issubset(*effective, *permitted))
273 return -EPERM;
274
275 new->cap_effective = *effective;
276 new->cap_inheritable = *inheritable;
277 new->cap_permitted = *permitted;
278
279
280
281
282
283 new->cap_ambient = cap_intersect(new->cap_ambient,
284 cap_intersect(*permitted,
285 *inheritable));
286 if (WARN_ON(!cap_ambient_invariant_ok(new)))
287 return -EINVAL;
288 return 0;
289}
290
291
292
293
294
295
296
297
298
299
300
301
302int cap_inode_need_killpriv(struct dentry *dentry)
303{
304 struct inode *inode = d_backing_inode(dentry);
305 int error;
306
307 error = __vfs_getxattr(dentry, inode, XATTR_NAME_CAPS, NULL, 0);
308 return error > 0;
309}
310
311
312
313
314
315
316
317
318
319int cap_inode_killpriv(struct dentry *dentry)
320{
321 int error;
322
323 error = __vfs_removexattr(dentry, XATTR_NAME_CAPS);
324 if (error == -EOPNOTSUPP)
325 error = 0;
326 return error;
327}
328
329static bool rootid_owns_currentns(kuid_t kroot)
330{
331 struct user_namespace *ns;
332
333 if (!uid_valid(kroot))
334 return false;
335
336 for (ns = current_user_ns(); ; ns = ns->parent) {
337 if (from_kuid(ns, kroot) == 0)
338 return true;
339 if (ns == &init_user_ns)
340 break;
341 }
342
343 return false;
344}
345
346static __u32 sansflags(__u32 m)
347{
348 return m & ~VFS_CAP_FLAGS_EFFECTIVE;
349}
350
351static bool is_v2header(size_t size, const struct vfs_cap_data *cap)
352{
353 if (size != XATTR_CAPS_SZ_2)
354 return false;
355 return sansflags(le32_to_cpu(cap->magic_etc)) == VFS_CAP_REVISION_2;
356}
357
358static bool is_v3header(size_t size, const struct vfs_cap_data *cap)
359{
360 if (size != XATTR_CAPS_SZ_3)
361 return false;
362 return sansflags(le32_to_cpu(cap->magic_etc)) == VFS_CAP_REVISION_3;
363}
364
365
366
367
368
369
370
371
372
373
374
375
376int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
377 bool alloc)
378{
379 int size, ret;
380 kuid_t kroot;
381 uid_t root, mappedroot;
382 char *tmpbuf = NULL;
383 struct vfs_cap_data *cap;
384 struct vfs_ns_cap_data *nscap;
385 struct dentry *dentry;
386 struct user_namespace *fs_ns;
387
388 if (strcmp(name, "capability") != 0)
389 return -EOPNOTSUPP;
390
391 dentry = d_find_alias(inode);
392 if (!dentry)
393 return -EINVAL;
394
395 size = sizeof(struct vfs_ns_cap_data);
396 ret = (int) vfs_getxattr_alloc(dentry, XATTR_NAME_CAPS,
397 &tmpbuf, size, GFP_NOFS);
398 dput(dentry);
399
400 if (ret < 0)
401 return ret;
402
403 fs_ns = inode->i_sb->s_user_ns;
404 cap = (struct vfs_cap_data *) tmpbuf;
405 if (is_v2header((size_t) ret, cap)) {
406
407
408 if (alloc)
409 *buffer = tmpbuf;
410 else
411 kfree(tmpbuf);
412 return ret;
413 } else if (!is_v3header((size_t) ret, cap)) {
414 kfree(tmpbuf);
415 return -EINVAL;
416 }
417
418 nscap = (struct vfs_ns_cap_data *) tmpbuf;
419 root = le32_to_cpu(nscap->rootid);
420 kroot = make_kuid(fs_ns, root);
421
422
423
424 mappedroot = from_kuid(current_user_ns(), kroot);
425 if (mappedroot != (uid_t)-1 && mappedroot != (uid_t)0) {
426 if (alloc) {
427 *buffer = tmpbuf;
428 nscap->rootid = cpu_to_le32(mappedroot);
429 } else
430 kfree(tmpbuf);
431 return size;
432 }
433
434 if (!rootid_owns_currentns(kroot)) {
435 kfree(tmpbuf);
436 return -EOPNOTSUPP;
437 }
438
439
440 size = sizeof(struct vfs_cap_data);
441 if (alloc) {
442 *buffer = kmalloc(size, GFP_ATOMIC);
443 if (*buffer) {
444 struct vfs_cap_data *cap = *buffer;
445 __le32 nsmagic, magic;
446 magic = VFS_CAP_REVISION_2;
447 nsmagic = le32_to_cpu(nscap->magic_etc);
448 if (nsmagic & VFS_CAP_FLAGS_EFFECTIVE)
449 magic |= VFS_CAP_FLAGS_EFFECTIVE;
450 memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
451 cap->magic_etc = cpu_to_le32(magic);
452 } else {
453 size = -ENOMEM;
454 }
455 }
456 kfree(tmpbuf);
457 return size;
458}
459
460static kuid_t rootid_from_xattr(const void *value, size_t size,
461 struct user_namespace *task_ns)
462{
463 const struct vfs_ns_cap_data *nscap = value;
464 uid_t rootid = 0;
465
466 if (size == XATTR_CAPS_SZ_3)
467 rootid = le32_to_cpu(nscap->rootid);
468
469 return make_kuid(task_ns, rootid);
470}
471
472static bool validheader(size_t size, const struct vfs_cap_data *cap)
473{
474 return is_v2header(size, cap) || is_v3header(size, cap);
475}
476
477
478
479
480
481
482
483int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size)
484{
485 struct vfs_ns_cap_data *nscap;
486 uid_t nsrootid;
487 const struct vfs_cap_data *cap = *ivalue;
488 __u32 magic, nsmagic;
489 struct inode *inode = d_backing_inode(dentry);
490 struct user_namespace *task_ns = current_user_ns(),
491 *fs_ns = inode->i_sb->s_user_ns;
492 kuid_t rootid;
493 size_t newsize;
494
495 if (!*ivalue)
496 return -EINVAL;
497 if (!validheader(size, cap))
498 return -EINVAL;
499 if (!capable_wrt_inode_uidgid(inode, CAP_SETFCAP))
500 return -EPERM;
501 if (size == XATTR_CAPS_SZ_2)
502 if (ns_capable(inode->i_sb->s_user_ns, CAP_SETFCAP))
503
504 return size;
505
506 rootid = rootid_from_xattr(*ivalue, size, task_ns);
507 if (!uid_valid(rootid))
508 return -EINVAL;
509
510 nsrootid = from_kuid(fs_ns, rootid);
511 if (nsrootid == -1)
512 return -EINVAL;
513
514 newsize = sizeof(struct vfs_ns_cap_data);
515 nscap = kmalloc(newsize, GFP_ATOMIC);
516 if (!nscap)
517 return -ENOMEM;
518 nscap->rootid = cpu_to_le32(nsrootid);
519 nsmagic = VFS_CAP_REVISION_3;
520 magic = le32_to_cpu(cap->magic_etc);
521 if (magic & VFS_CAP_FLAGS_EFFECTIVE)
522 nsmagic |= VFS_CAP_FLAGS_EFFECTIVE;
523 nscap->magic_etc = cpu_to_le32(nsmagic);
524 memcpy(&nscap->data, &cap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
525
526 kvfree(*ivalue);
527 *ivalue = nscap;
528 return newsize;
529}
530
531
532
533
534
535static inline int bprm_caps_from_vfs_caps(struct cpu_vfs_cap_data *caps,
536 struct linux_binprm *bprm,
537 bool *effective,
538 bool *has_fcap)
539{
540 struct cred *new = bprm->cred;
541 unsigned i;
542 int ret = 0;
543
544 if (caps->magic_etc & VFS_CAP_FLAGS_EFFECTIVE)
545 *effective = true;
546
547 if (caps->magic_etc & VFS_CAP_REVISION_MASK)
548 *has_fcap = true;
549
550 CAP_FOR_EACH_U32(i) {
551 __u32 permitted = caps->permitted.cap[i];
552 __u32 inheritable = caps->inheritable.cap[i];
553
554
555
556
557
558 new->cap_permitted.cap[i] =
559 (new->cap_bset.cap[i] & permitted) |
560 (new->cap_inheritable.cap[i] & inheritable);
561
562 if (permitted & ~new->cap_permitted.cap[i])
563
564 ret = -EPERM;
565 }
566
567
568
569
570
571
572 return *effective ? ret : 0;
573}
574
575
576
577
578int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps)
579{
580 struct inode *inode = d_backing_inode(dentry);
581 __u32 magic_etc;
582 unsigned tocopy, i;
583 int size;
584 struct vfs_ns_cap_data data, *nscaps = &data;
585 struct vfs_cap_data *caps = (struct vfs_cap_data *) &data;
586 kuid_t rootkuid;
587 struct user_namespace *fs_ns;
588
589 memset(cpu_caps, 0, sizeof(struct cpu_vfs_cap_data));
590
591 if (!inode)
592 return -ENODATA;
593
594 fs_ns = inode->i_sb->s_user_ns;
595 size = __vfs_getxattr((struct dentry *)dentry, inode,
596 XATTR_NAME_CAPS, &data, XATTR_CAPS_SZ);
597 if (size == -ENODATA || size == -EOPNOTSUPP)
598
599 return -ENODATA;
600
601 if (size < 0)
602 return size;
603
604 if (size < sizeof(magic_etc))
605 return -EINVAL;
606
607 cpu_caps->magic_etc = magic_etc = le32_to_cpu(caps->magic_etc);
608
609 rootkuid = make_kuid(fs_ns, 0);
610 switch (magic_etc & VFS_CAP_REVISION_MASK) {
611 case VFS_CAP_REVISION_1:
612 if (size != XATTR_CAPS_SZ_1)
613 return -EINVAL;
614 tocopy = VFS_CAP_U32_1;
615 break;
616 case VFS_CAP_REVISION_2:
617 if (size != XATTR_CAPS_SZ_2)
618 return -EINVAL;
619 tocopy = VFS_CAP_U32_2;
620 break;
621 case VFS_CAP_REVISION_3:
622 if (size != XATTR_CAPS_SZ_3)
623 return -EINVAL;
624 tocopy = VFS_CAP_U32_3;
625 rootkuid = make_kuid(fs_ns, le32_to_cpu(nscaps->rootid));
626 break;
627
628 default:
629 return -EINVAL;
630 }
631
632
633
634 if (!rootid_owns_currentns(rootkuid))
635 return -ENODATA;
636
637 CAP_FOR_EACH_U32(i) {
638 if (i >= tocopy)
639 break;
640 cpu_caps->permitted.cap[i] = le32_to_cpu(caps->data[i].permitted);
641 cpu_caps->inheritable.cap[i] = le32_to_cpu(caps->data[i].inheritable);
642 }
643
644 cpu_caps->permitted.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
645 cpu_caps->inheritable.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
646
647 return 0;
648}
649
650
651
652
653
654
655static int get_file_caps(struct linux_binprm *bprm, bool *effective, bool *has_fcap)
656{
657 int rc = 0;
658 struct cpu_vfs_cap_data vcaps;
659
660 cap_clear(bprm->cred->cap_permitted);
661
662 if (!file_caps_enabled)
663 return 0;
664
665 if (!mnt_may_suid(bprm->file->f_path.mnt))
666 return 0;
667
668
669
670
671
672
673 if (!current_in_userns(bprm->file->f_path.mnt->mnt_sb->s_user_ns))
674 return 0;
675
676 rc = get_vfs_caps_from_disk(bprm->file->f_path.dentry, &vcaps);
677 if (rc < 0) {
678 if (rc == -EINVAL)
679 printk(KERN_NOTICE "Invalid argument reading file caps for %s\n",
680 bprm->filename);
681 else if (rc == -ENODATA)
682 rc = 0;
683 goto out;
684 }
685
686 rc = bprm_caps_from_vfs_caps(&vcaps, bprm, effective, has_fcap);
687 if (rc == -EINVAL)
688 printk(KERN_NOTICE "%s: cap_from_disk returned %d for %s\n",
689 __func__, rc, bprm->filename);
690
691out:
692 if (rc)
693 cap_clear(bprm->cred->cap_permitted);
694
695 return rc;
696}
697
698static inline bool root_privileged(void) { return !issecure(SECURE_NOROOT); }
699
700static inline bool __is_real(kuid_t uid, struct cred *cred)
701{ return uid_eq(cred->uid, uid); }
702
703static inline bool __is_eff(kuid_t uid, struct cred *cred)
704{ return uid_eq(cred->euid, uid); }
705
706static inline bool __is_suid(kuid_t uid, struct cred *cred)
707{ return !__is_real(uid, cred) && __is_eff(uid, cred); }
708
709
710
711
712
713
714
715
716
717
718
719
720
721static void handle_privileged_root(struct linux_binprm *bprm, bool has_fcap,
722 bool *effective, kuid_t root_uid)
723{
724 const struct cred *old = current_cred();
725 struct cred *new = bprm->cred;
726
727 if (!root_privileged())
728 return;
729
730
731
732
733
734 if (has_fcap && __is_suid(root_uid, new)) {
735 warn_setuid_and_fcaps_mixed(bprm->filename);
736 return;
737 }
738
739
740
741
742
743 if (__is_eff(root_uid, new) || __is_real(root_uid, new)) {
744
745 new->cap_permitted = cap_combine(old->cap_bset,
746 old->cap_inheritable);
747 }
748
749
750
751 if (__is_eff(root_uid, new))
752 *effective = true;
753}
754
755#define __cap_gained(field, target, source) \
756 !cap_issubset(target->cap_##field, source->cap_##field)
757#define __cap_grew(target, source, cred) \
758 !cap_issubset(cred->cap_##target, cred->cap_##source)
759#define __cap_full(field, cred) \
760 cap_issubset(CAP_FULL_SET, cred->cap_##field)
761
762static inline bool __is_setuid(struct cred *new, const struct cred *old)
763{ return !uid_eq(new->euid, old->uid); }
764
765static inline bool __is_setgid(struct cred *new, const struct cred *old)
766{ return !gid_eq(new->egid, old->gid); }
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785static inline bool nonroot_raised_pE(struct cred *new, const struct cred *old,
786 kuid_t root, bool has_fcap)
787{
788 bool ret = false;
789
790 if ((__cap_grew(effective, ambient, new) &&
791 !(__cap_full(effective, new) &&
792 (__is_eff(root, new) || __is_real(root, new)) &&
793 root_privileged())) ||
794 (root_privileged() &&
795 __is_suid(root, new) &&
796 !__cap_full(effective, new)) ||
797 (!__is_setuid(new, old) &&
798 ((has_fcap &&
799 __cap_gained(permitted, new, old)) ||
800 __cap_gained(ambient, new, old))))
801
802 ret = true;
803
804 return ret;
805}
806
807
808
809
810
811
812
813
814
815int cap_bprm_set_creds(struct linux_binprm *bprm)
816{
817 const struct cred *old = current_cred();
818 struct cred *new = bprm->cred;
819 bool effective = false, has_fcap = false, is_setid;
820 int ret;
821 kuid_t root_uid;
822
823 if (WARN_ON(!cap_ambient_invariant_ok(old)))
824 return -EPERM;
825
826 ret = get_file_caps(bprm, &effective, &has_fcap);
827 if (ret < 0)
828 return ret;
829
830 root_uid = make_kuid(new->user_ns, 0);
831
832 handle_privileged_root(bprm, has_fcap, &effective, root_uid);
833
834
835 if (__cap_gained(permitted, new, old))
836 bprm->per_clear |= PER_CLEAR_ON_SETID;
837
838
839
840
841
842
843 is_setid = __is_setuid(new, old) || __is_setgid(new, old);
844
845 if ((is_setid || __cap_gained(permitted, new, old)) &&
846 ((bprm->unsafe & ~LSM_UNSAFE_PTRACE) ||
847 !ptracer_capable(current, new->user_ns))) {
848
849 if (!ns_capable(new->user_ns, CAP_SETUID) ||
850 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)) {
851 new->euid = new->uid;
852 new->egid = new->gid;
853 }
854 new->cap_permitted = cap_intersect(new->cap_permitted,
855 old->cap_permitted);
856 }
857
858 new->suid = new->fsuid = new->euid;
859 new->sgid = new->fsgid = new->egid;
860
861
862 if (has_fcap || is_setid)
863 cap_clear(new->cap_ambient);
864
865
866
867
868
869 new->cap_permitted = cap_combine(new->cap_permitted, new->cap_ambient);
870
871
872
873
874
875 if (effective)
876 new->cap_effective = new->cap_permitted;
877 else
878 new->cap_effective = new->cap_ambient;
879
880 if (WARN_ON(!cap_ambient_invariant_ok(new)))
881 return -EPERM;
882
883 if (nonroot_raised_pE(new, old, root_uid, has_fcap)) {
884 ret = audit_log_bprm_fcaps(bprm, new, old);
885 if (ret < 0)
886 return ret;
887 }
888
889 new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
890
891 if (WARN_ON(!cap_ambient_invariant_ok(new)))
892 return -EPERM;
893
894
895 bprm->cap_elevated = 0;
896 if (is_setid ||
897 (!__is_real(root_uid, new) &&
898 (effective ||
899 __cap_grew(permitted, ambient, new))))
900 bprm->cap_elevated = 1;
901
902 return 0;
903}
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919int cap_inode_setxattr(struct dentry *dentry, const char *name,
920 const void *value, size_t size, int flags)
921{
922
923 if (strncmp(name, XATTR_SECURITY_PREFIX,
924 sizeof(XATTR_SECURITY_PREFIX) - 1) != 0)
925 return 0;
926
927
928
929
930
931 if (strcmp(name, XATTR_NAME_CAPS) == 0)
932 return 0;
933
934 if (!capable(CAP_SYS_ADMIN))
935 return -EPERM;
936 return 0;
937}
938
939
940
941
942
943
944
945
946
947
948
949
950int cap_inode_removexattr(struct dentry *dentry, const char *name)
951{
952
953 if (strncmp(name, XATTR_SECURITY_PREFIX,
954 sizeof(XATTR_SECURITY_PREFIX) - 1) != 0)
955 return 0;
956
957 if (strcmp(name, XATTR_NAME_CAPS) == 0) {
958
959 struct inode *inode = d_backing_inode(dentry);
960 if (!inode)
961 return -EINVAL;
962 if (!capable_wrt_inode_uidgid(inode, CAP_SETFCAP))
963 return -EPERM;
964 return 0;
965 }
966
967 if (!capable(CAP_SYS_ADMIN))
968 return -EPERM;
969 return 0;
970}
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)
1002{
1003 kuid_t root_uid = make_kuid(old->user_ns, 0);
1004
1005 if ((uid_eq(old->uid, root_uid) ||
1006 uid_eq(old->euid, root_uid) ||
1007 uid_eq(old->suid, root_uid)) &&
1008 (!uid_eq(new->uid, root_uid) &&
1009 !uid_eq(new->euid, root_uid) &&
1010 !uid_eq(new->suid, root_uid))) {
1011 if (!issecure(SECURE_KEEP_CAPS)) {
1012 cap_clear(new->cap_permitted);
1013 cap_clear(new->cap_effective);
1014 }
1015
1016
1017
1018
1019
1020
1021 cap_clear(new->cap_ambient);
1022 }
1023 if (uid_eq(old->euid, root_uid) && !uid_eq(new->euid, root_uid))
1024 cap_clear(new->cap_effective);
1025 if (!uid_eq(old->euid, root_uid) && uid_eq(new->euid, root_uid))
1026 new->cap_effective = new->cap_permitted;
1027}
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
1039{
1040 switch (flags) {
1041 case LSM_SETID_RE:
1042 case LSM_SETID_ID:
1043 case LSM_SETID_RES:
1044
1045
1046 if (!issecure(SECURE_NO_SETUID_FIXUP))
1047 cap_emulate_setxuid(new, old);
1048 break;
1049
1050 case LSM_SETID_FS:
1051
1052
1053
1054
1055
1056
1057 if (!issecure(SECURE_NO_SETUID_FIXUP)) {
1058 kuid_t root_uid = make_kuid(old->user_ns, 0);
1059 if (uid_eq(old->fsuid, root_uid) && !uid_eq(new->fsuid, root_uid))
1060 new->cap_effective =
1061 cap_drop_fs_set(new->cap_effective);
1062
1063 if (!uid_eq(old->fsuid, root_uid) && uid_eq(new->fsuid, root_uid))
1064 new->cap_effective =
1065 cap_raise_fs_set(new->cap_effective,
1066 new->cap_permitted);
1067 }
1068 break;
1069
1070 default:
1071 return -EINVAL;
1072 }
1073
1074 return 0;
1075}
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087static int cap_safe_nice(struct task_struct *p)
1088{
1089 int is_subset, ret = 0;
1090
1091 rcu_read_lock();
1092 is_subset = cap_issubset(__task_cred(p)->cap_permitted,
1093 current_cred()->cap_permitted);
1094 if (!is_subset && !ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE))
1095 ret = -EPERM;
1096 rcu_read_unlock();
1097
1098 return ret;
1099}
1100
1101
1102
1103
1104
1105
1106
1107
1108int cap_task_setscheduler(struct task_struct *p)
1109{
1110 return cap_safe_nice(p);
1111}
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121int cap_task_setioprio(struct task_struct *p, int ioprio)
1122{
1123 return cap_safe_nice(p);
1124}
1125
1126
1127
1128
1129
1130
1131
1132
1133
1134int cap_task_setnice(struct task_struct *p, int nice)
1135{
1136 return cap_safe_nice(p);
1137}
1138
1139
1140
1141
1142
1143static int cap_prctl_drop(unsigned long cap)
1144{
1145 struct cred *new;
1146
1147 if (!ns_capable(current_user_ns(), CAP_SETPCAP))
1148 return -EPERM;
1149 if (!cap_valid(cap))
1150 return -EINVAL;
1151
1152 new = prepare_creds();
1153 if (!new)
1154 return -ENOMEM;
1155 cap_lower(new->cap_bset, cap);
1156 return commit_creds(new);
1157}
1158
1159
1160
1161
1162
1163
1164
1165
1166
1167
1168
1169
1170
1171int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
1172 unsigned long arg4, unsigned long arg5)
1173{
1174 const struct cred *old = current_cred();
1175 struct cred *new;
1176
1177 switch (option) {
1178 case PR_CAPBSET_READ:
1179 if (!cap_valid(arg2))
1180 return -EINVAL;
1181 return !!cap_raised(old->cap_bset, arg2);
1182
1183 case PR_CAPBSET_DROP:
1184 return cap_prctl_drop(arg2);
1185
1186
1187
1188
1189
1190
1191
1192
1193
1194
1195
1196
1197
1198
1199
1200
1201
1202
1203
1204
1205 case PR_SET_SECUREBITS:
1206 if ((((old->securebits & SECURE_ALL_LOCKS) >> 1)
1207 & (old->securebits ^ arg2))
1208 || ((old->securebits & SECURE_ALL_LOCKS & ~arg2))
1209 || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS))
1210 || (cap_capable(current_cred(),
1211 current_cred()->user_ns, CAP_SETPCAP,
1212 SECURITY_CAP_AUDIT) != 0)
1213
1214
1215
1216
1217
1218
1219
1220 )
1221
1222 return -EPERM;
1223
1224 new = prepare_creds();
1225 if (!new)
1226 return -ENOMEM;
1227 new->securebits = arg2;
1228 return commit_creds(new);
1229
1230 case PR_GET_SECUREBITS:
1231 return old->securebits;
1232
1233 case PR_GET_KEEPCAPS:
1234 return !!issecure(SECURE_KEEP_CAPS);
1235
1236 case PR_SET_KEEPCAPS:
1237 if (arg2 > 1)
1238 return -EINVAL;
1239 if (issecure(SECURE_KEEP_CAPS_LOCKED))
1240 return -EPERM;
1241
1242 new = prepare_creds();
1243 if (!new)
1244 return -ENOMEM;
1245 if (arg2)
1246 new->securebits |= issecure_mask(SECURE_KEEP_CAPS);
1247 else
1248 new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
1249 return commit_creds(new);
1250
1251 case PR_CAP_AMBIENT:
1252 if (arg2 == PR_CAP_AMBIENT_CLEAR_ALL) {
1253 if (arg3 | arg4 | arg5)
1254 return -EINVAL;
1255
1256 new = prepare_creds();
1257 if (!new)
1258 return -ENOMEM;
1259 cap_clear(new->cap_ambient);
1260 return commit_creds(new);
1261 }
1262
1263 if (((!cap_valid(arg3)) | arg4 | arg5))
1264 return -EINVAL;
1265
1266 if (arg2 == PR_CAP_AMBIENT_IS_SET) {
1267 return !!cap_raised(current_cred()->cap_ambient, arg3);
1268 } else if (arg2 != PR_CAP_AMBIENT_RAISE &&
1269 arg2 != PR_CAP_AMBIENT_LOWER) {
1270 return -EINVAL;
1271 } else {
1272 if (arg2 == PR_CAP_AMBIENT_RAISE &&
1273 (!cap_raised(current_cred()->cap_permitted, arg3) ||
1274 !cap_raised(current_cred()->cap_inheritable,
1275 arg3) ||
1276 issecure(SECURE_NO_CAP_AMBIENT_RAISE)))
1277 return -EPERM;
1278
1279 new = prepare_creds();
1280 if (!new)
1281 return -ENOMEM;
1282 if (arg2 == PR_CAP_AMBIENT_RAISE)
1283 cap_raise(new->cap_ambient, arg3);
1284 else
1285 cap_lower(new->cap_ambient, arg3);
1286 return commit_creds(new);
1287 }
1288
1289 default:
1290
1291 return -ENOSYS;
1292 }
1293}
1294
1295
1296
1297
1298
1299
1300
1301
1302
1303int cap_vm_enough_memory(struct mm_struct *mm, long pages)
1304{
1305 int cap_sys_admin = 0;
1306
1307 if (cap_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
1308 SECURITY_CAP_NOAUDIT) == 0)
1309 cap_sys_admin = 1;
1310 return cap_sys_admin;
1311}
1312
1313
1314
1315
1316
1317
1318
1319
1320
1321
1322int cap_mmap_addr(unsigned long addr)
1323{
1324 int ret = 0;
1325
1326 if (addr < dac_mmap_min_addr) {
1327 ret = cap_capable(current_cred(), &init_user_ns, CAP_SYS_RAWIO,
1328 SECURITY_CAP_AUDIT);
1329
1330 if (ret == 0)
1331 current->flags |= PF_SUPERPRIV;
1332 }
1333 return ret;
1334}
1335
1336int cap_mmap_file(struct file *file, unsigned long reqprot,
1337 unsigned long prot, unsigned long flags)
1338{
1339 return 0;
1340}
1341
1342#ifdef CONFIG_SECURITY
1343
1344struct security_hook_list capability_hooks[] __lsm_ro_after_init = {
1345 LSM_HOOK_INIT(capable, cap_capable),
1346 LSM_HOOK_INIT(settime, cap_settime),
1347 LSM_HOOK_INIT(ptrace_access_check, cap_ptrace_access_check),
1348 LSM_HOOK_INIT(ptrace_traceme, cap_ptrace_traceme),
1349 LSM_HOOK_INIT(capget, cap_capget),
1350 LSM_HOOK_INIT(capset, cap_capset),
1351 LSM_HOOK_INIT(bprm_set_creds, cap_bprm_set_creds),
1352 LSM_HOOK_INIT(inode_need_killpriv, cap_inode_need_killpriv),
1353 LSM_HOOK_INIT(inode_killpriv, cap_inode_killpriv),
1354 LSM_HOOK_INIT(inode_getsecurity, cap_inode_getsecurity),
1355 LSM_HOOK_INIT(mmap_addr, cap_mmap_addr),
1356 LSM_HOOK_INIT(mmap_file, cap_mmap_file),
1357 LSM_HOOK_INIT(task_fix_setuid, cap_task_fix_setuid),
1358 LSM_HOOK_INIT(task_prctl, cap_task_prctl),
1359 LSM_HOOK_INIT(task_setscheduler, cap_task_setscheduler),
1360 LSM_HOOK_INIT(task_setioprio, cap_task_setioprio),
1361 LSM_HOOK_INIT(task_setnice, cap_task_setnice),
1362 LSM_HOOK_INIT(vm_enough_memory, cap_vm_enough_memory),
1363};
1364
1365void __init capability_add_hooks(void)
1366{
1367 security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks),
1368 "capability");
1369}
1370
1371#endif
1372