blob: 9e4697e9b276e7429fed888b76c8e4ee19562e4c [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * linux/kernel/capability.c
3 *
4 * Copyright (C) 1997 Andrew Main <zefram@fysh.org>
5 *
Andrew Morgan72c2d582007-10-18 03:05:59 -07006 * Integrated into 2.1.97+, Andrew G. Morgan <morgan@kernel.org>
Linus Torvalds1da177e2005-04-16 15:20:36 -07007 * 30 May 2002: Cleanup, Robert M. Love <rml@tech9.net>
Daniel Walker314f70f2007-10-18 03:06:08 -07008 */
Linus Torvalds1da177e2005-04-16 15:20:36 -07009
Eric Parise68b75a02008-11-11 21:48:22 +110010#include <linux/audit.h>
Randy.Dunlapc59ede72006-01-11 12:17:46 -080011#include <linux/capability.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070012#include <linux/mm.h>
13#include <linux/module.h>
14#include <linux/security.h>
15#include <linux/syscalls.h>
Serge E. Hallynb460cbc2007-10-18 23:39:52 -070016#include <linux/pid_namespace.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070017#include <asm/uaccess.h>
David Howellsd84f4f92008-11-14 10:39:23 +110018#include "cred-internals.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -070019
20/*
Andrew Morgane338d262008-02-04 22:29:42 -080021 * Leveraged for setting/resetting capabilities
22 */
23
24const kernel_cap_t __cap_empty_set = CAP_EMPTY_SET;
25const kernel_cap_t __cap_full_set = CAP_FULL_SET;
26const kernel_cap_t __cap_init_eff_set = CAP_INIT_EFF_SET;
27
28EXPORT_SYMBOL(__cap_empty_set);
29EXPORT_SYMBOL(__cap_full_set);
30EXPORT_SYMBOL(__cap_init_eff_set);
31
Serge E. Hallyn1f29fae2008-11-05 16:08:52 -060032int file_caps_enabled = 1;
33
34static int __init file_caps_disable(char *str)
35{
36 file_caps_enabled = 0;
37 return 1;
38}
39__setup("no_file_caps", file_caps_disable);
Serge E. Hallyn1f29fae2008-11-05 16:08:52 -060040
Andrew Morgane338d262008-02-04 22:29:42 -080041/*
42 * More recent versions of libcap are available from:
43 *
44 * http://www.kernel.org/pub/linux/libs/security/linux-privs/
45 */
46
47static void warn_legacy_capability_use(void)
48{
49 static int warned;
50 if (!warned) {
51 char name[sizeof(current->comm)];
52
53 printk(KERN_INFO "warning: `%s' uses 32-bit capabilities"
54 " (legacy support in use)\n",
55 get_task_comm(name, current));
56 warned = 1;
57 }
58}
59
60/*
Andrew G. Morganca05a992008-05-27 22:05:17 -070061 * Version 2 capabilities worked fine, but the linux/capability.h file
62 * that accompanied their introduction encouraged their use without
63 * the necessary user-space source code changes. As such, we have
64 * created a version 3 with equivalent functionality to version 2, but
65 * with a header change to protect legacy source code from using
66 * version 2 when it wanted to use version 1. If your system has code
67 * that trips the following warning, it is using version 2 specific
68 * capabilities and may be doing so insecurely.
69 *
70 * The remedy is to either upgrade your version of libcap (to 2.10+,
71 * if the application is linked against it), or recompile your
72 * application with modern kernel headers and this warning will go
73 * away.
74 */
75
76static void warn_deprecated_v2(void)
77{
78 static int warned;
79
80 if (!warned) {
81 char name[sizeof(current->comm)];
82
83 printk(KERN_INFO "warning: `%s' uses deprecated v2"
84 " capabilities in a way that may be insecure.\n",
85 get_task_comm(name, current));
86 warned = 1;
87 }
88}
89
90/*
91 * Version check. Return the number of u32s in each capability flag
92 * array, or a negative value on error.
93 */
94static int cap_validate_magic(cap_user_header_t header, unsigned *tocopy)
95{
96 __u32 version;
97
98 if (get_user(version, &header->version))
99 return -EFAULT;
100
101 switch (version) {
102 case _LINUX_CAPABILITY_VERSION_1:
103 warn_legacy_capability_use();
104 *tocopy = _LINUX_CAPABILITY_U32S_1;
105 break;
106 case _LINUX_CAPABILITY_VERSION_2:
107 warn_deprecated_v2();
108 /*
109 * fall through - v3 is otherwise equivalent to v2.
110 */
111 case _LINUX_CAPABILITY_VERSION_3:
112 *tocopy = _LINUX_CAPABILITY_U32S_3;
113 break;
114 default:
115 if (put_user((u32)_KERNEL_CAPABILITY_VERSION, &header->version))
116 return -EFAULT;
117 return -EINVAL;
118 }
119
120 return 0;
121}
122
Andrew G. Morganab763c72008-07-23 21:28:25 -0700123/*
David Howellsd84f4f92008-11-14 10:39:23 +1100124 * The only thing that can change the capabilities of the current
125 * process is the current process. As such, we can't be in this code
126 * at the same time as we are in the process of setting capabilities
127 * in this process. The net result is that we can limit our use of
128 * locks to when we are reading the caps of another process.
Andrew G. Morganab763c72008-07-23 21:28:25 -0700129 */
130static inline int cap_get_target_pid(pid_t pid, kernel_cap_t *pEp,
131 kernel_cap_t *pIp, kernel_cap_t *pPp)
132{
133 int ret;
134
135 if (pid && (pid != task_pid_vnr(current))) {
136 struct task_struct *target;
137
Thomas Gleixner86fc80f2009-12-09 17:13:31 +0100138 rcu_read_lock();
Andrew G. Morganab763c72008-07-23 21:28:25 -0700139
140 target = find_task_by_vpid(pid);
141 if (!target)
142 ret = -ESRCH;
143 else
144 ret = security_capget(target, pEp, pIp, pPp);
145
Thomas Gleixner86fc80f2009-12-09 17:13:31 +0100146 rcu_read_unlock();
Andrew G. Morganab763c72008-07-23 21:28:25 -0700147 } else
148 ret = security_capget(current, pEp, pIp, pPp);
149
150 return ret;
151}
152
Randy Dunlap207a7ba2005-07-27 11:45:10 -0700153/**
Linus Torvalds1da177e2005-04-16 15:20:36 -0700154 * sys_capget - get the capabilities of a given process.
Randy Dunlap207a7ba2005-07-27 11:45:10 -0700155 * @header: pointer to struct that contains capability version and
156 * target pid data
157 * @dataptr: pointer to struct that contains the effective, permitted,
158 * and inheritable capabilities that are returned
159 *
160 * Returns 0 on success and < 0 on error.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700161 */
Heiko Carstensb290ebe2009-01-14 14:14:06 +0100162SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700163{
Daniel Walker314f70f2007-10-18 03:06:08 -0700164 int ret = 0;
165 pid_t pid;
Andrew Morgane338d262008-02-04 22:29:42 -0800166 unsigned tocopy;
167 kernel_cap_t pE, pI, pP;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700168
Andrew G. Morganca05a992008-05-27 22:05:17 -0700169 ret = cap_validate_magic(header, &tocopy);
Andrew G. Morganc4a5af52009-11-23 04:57:52 +0000170 if ((dataptr == NULL) || (ret != 0))
171 return ((dataptr == NULL) && (ret == -EINVAL)) ? 0 : ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700172
Daniel Walker314f70f2007-10-18 03:06:08 -0700173 if (get_user(pid, &header->pid))
174 return -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700175
Daniel Walker314f70f2007-10-18 03:06:08 -0700176 if (pid < 0)
177 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700178
Andrew G. Morganab763c72008-07-23 21:28:25 -0700179 ret = cap_get_target_pid(pid, &pE, &pI, &pP);
Andrew Morgane338d262008-02-04 22:29:42 -0800180 if (!ret) {
Andrew G. Morganca05a992008-05-27 22:05:17 -0700181 struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S];
Andrew Morgane338d262008-02-04 22:29:42 -0800182 unsigned i;
183
184 for (i = 0; i < tocopy; i++) {
185 kdata[i].effective = pE.cap[i];
186 kdata[i].permitted = pP.cap[i];
187 kdata[i].inheritable = pI.cap[i];
188 }
189
190 /*
Andrew G. Morganca05a992008-05-27 22:05:17 -0700191 * Note, in the case, tocopy < _KERNEL_CAPABILITY_U32S,
Andrew Morgane338d262008-02-04 22:29:42 -0800192 * we silently drop the upper capabilities here. This
193 * has the effect of making older libcap
194 * implementations implicitly drop upper capability
195 * bits when they perform a: capget/modify/capset
196 * sequence.
197 *
198 * This behavior is considered fail-safe
199 * behavior. Upgrading the application to a newer
200 * version of libcap will enable access to the newer
201 * capabilities.
202 *
203 * An alternative would be to return an error here
204 * (-ERANGE), but that causes legacy applications to
205 * unexpectidly fail; the capget/modify/capset aborts
206 * before modification is attempted and the application
207 * fails.
208 */
Andrew Morgane338d262008-02-04 22:29:42 -0800209 if (copy_to_user(dataptr, kdata, tocopy
210 * sizeof(struct __user_cap_data_struct))) {
211 return -EFAULT;
212 }
213 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700214
Daniel Walker314f70f2007-10-18 03:06:08 -0700215 return ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700216}
217
Randy Dunlap207a7ba2005-07-27 11:45:10 -0700218/**
Andrew G. Morganab763c72008-07-23 21:28:25 -0700219 * sys_capset - set capabilities for a process or (*) a group of processes
Randy Dunlap207a7ba2005-07-27 11:45:10 -0700220 * @header: pointer to struct that contains capability version and
221 * target pid data
222 * @data: pointer to struct that contains the effective, permitted,
223 * and inheritable capabilities
224 *
David Howells1cdcbec2008-11-14 10:39:14 +1100225 * Set capabilities for the current process only. The ability to any other
226 * process(es) has been deprecated and removed.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700227 *
228 * The restrictions on setting capabilities are specified as:
229 *
David Howells1cdcbec2008-11-14 10:39:14 +1100230 * I: any raised capabilities must be a subset of the old permitted
231 * P: any raised capabilities must be a subset of the old permitted
232 * E: must be set to a subset of new permitted
Randy Dunlap207a7ba2005-07-27 11:45:10 -0700233 *
234 * Returns 0 on success and < 0 on error.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700235 */
Heiko Carstensb290ebe2009-01-14 14:14:06 +0100236SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700237{
Andrew G. Morganca05a992008-05-27 22:05:17 -0700238 struct __user_cap_data_struct kdata[_KERNEL_CAPABILITY_U32S];
Arjan van de Ven825332e2009-10-14 08:17:36 +1100239 unsigned i, tocopy, copybytes;
Daniel Walker314f70f2007-10-18 03:06:08 -0700240 kernel_cap_t inheritable, permitted, effective;
David Howellsd84f4f92008-11-14 10:39:23 +1100241 struct cred *new;
Daniel Walker314f70f2007-10-18 03:06:08 -0700242 int ret;
243 pid_t pid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700244
Andrew G. Morganca05a992008-05-27 22:05:17 -0700245 ret = cap_validate_magic(header, &tocopy);
246 if (ret != 0)
247 return ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700248
Daniel Walker314f70f2007-10-18 03:06:08 -0700249 if (get_user(pid, &header->pid))
250 return -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700251
David Howells1cdcbec2008-11-14 10:39:14 +1100252 /* may only affect current now */
253 if (pid != 0 && pid != task_pid_vnr(current))
254 return -EPERM;
255
Arjan van de Ven825332e2009-10-14 08:17:36 +1100256 copybytes = tocopy * sizeof(struct __user_cap_data_struct);
257 if (copybytes > sizeof(kdata))
258 return -EFAULT;
259
260 if (copy_from_user(&kdata, data, copybytes))
Daniel Walker314f70f2007-10-18 03:06:08 -0700261 return -EFAULT;
Andrew Morgane338d262008-02-04 22:29:42 -0800262
263 for (i = 0; i < tocopy; i++) {
264 effective.cap[i] = kdata[i].effective;
265 permitted.cap[i] = kdata[i].permitted;
266 inheritable.cap[i] = kdata[i].inheritable;
267 }
Andrew G. Morganca05a992008-05-27 22:05:17 -0700268 while (i < _KERNEL_CAPABILITY_U32S) {
Andrew Morgane338d262008-02-04 22:29:42 -0800269 effective.cap[i] = 0;
270 permitted.cap[i] = 0;
271 inheritable.cap[i] = 0;
272 i++;
273 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700274
David Howellsd84f4f92008-11-14 10:39:23 +1100275 new = prepare_creds();
276 if (!new)
277 return -ENOMEM;
278
279 ret = security_capset(new, current_cred(),
280 &effective, &inheritable, &permitted);
281 if (ret < 0)
282 goto error;
283
Al Viro57f71a02009-01-04 14:52:57 -0500284 audit_log_capset(pid, new, current_cred());
Eric Parise68b75a02008-11-11 21:48:22 +1100285
David Howellsd84f4f92008-11-14 10:39:23 +1100286 return commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700287
David Howellsd84f4f92008-11-14 10:39:23 +1100288error:
289 abort_creds(new);
Daniel Walker314f70f2007-10-18 03:06:08 -0700290 return ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700291}
Chris Wright12b59892006-03-25 03:07:41 -0800292
David Howells5cd9c582008-08-14 11:37:28 +0100293/**
294 * capable - Determine if the current task has a superior capability in effect
295 * @cap: The capability to be tested for
296 *
297 * Return true if the current task has the given superior capability currently
298 * available for use, false if not.
299 *
300 * This sets PF_SUPERPRIV on the task if the capability is available on the
301 * assumption that it's about to be used.
302 */
303int capable(int cap)
Chris Wright12b59892006-03-25 03:07:41 -0800304{
Eric Paris637d32d2008-10-29 15:42:12 +1100305 if (unlikely(!cap_valid(cap))) {
306 printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
307 BUG();
308 }
309
David Howells3699c532009-01-06 22:27:01 +0000310 if (security_capable(cap) == 0) {
David Howells5cd9c582008-08-14 11:37:28 +0100311 current->flags |= PF_SUPERPRIV;
Chris Wright12b59892006-03-25 03:07:41 -0800312 return 1;
313 }
314 return 0;
315}
Chris Wright12b59892006-03-25 03:07:41 -0800316EXPORT_SYMBOL(capable);