blob: beac0258c2a8f3a0cbad52ec9adf12e019264626 [file] [log] [blame]
Andrew Morgane338d262008-02-04 22:29:42 -08001/* Common capabilities, needed by capability.o and root_plug.o
Linus Torvalds1da177e2005-04-16 15:20:36 -07002 *
3 * This program is free software; you can redistribute it and/or modify
4 * it under the terms of the GNU General Public License as published by
5 * the Free Software Foundation; either version 2 of the License, or
6 * (at your option) any later version.
7 *
8 */
9
Randy.Dunlapc59ede72006-01-11 12:17:46 -080010#include <linux/capability.h>
Eric Paris3fc689e2008-11-11 21:48:18 +110011#include <linux/audit.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070012#include <linux/module.h>
13#include <linux/init.h>
14#include <linux/kernel.h>
15#include <linux/security.h>
16#include <linux/file.h>
17#include <linux/mm.h>
18#include <linux/mman.h>
19#include <linux/pagemap.h>
20#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070021#include <linux/skbuff.h>
22#include <linux/netlink.h>
23#include <linux/ptrace.h>
24#include <linux/xattr.h>
25#include <linux/hugetlb.h>
Serge E. Hallynb5376772007-10-16 23:31:36 -070026#include <linux/mount.h>
Serge E. Hallynb460cbc2007-10-18 23:39:52 -070027#include <linux/sched.h>
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -070028#include <linux/prctl.h>
29#include <linux/securebits.h>
Andrew Morgan72c2d582007-10-18 03:05:59 -070030
Linus Torvalds1da177e2005-04-16 15:20:36 -070031int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
32{
David Howellsb6dff3e2008-11-14 10:39:16 +110033 NETLINK_CB(skb).eff_cap = current_cap();
Linus Torvalds1da177e2005-04-16 15:20:36 -070034 return 0;
35}
36
Darrel Goeddelc7bdb542006-06-27 13:26:11 -070037int cap_netlink_recv(struct sk_buff *skb, int cap)
Linus Torvalds1da177e2005-04-16 15:20:36 -070038{
Darrel Goeddelc7bdb542006-06-27 13:26:11 -070039 if (!cap_raised(NETLINK_CB(skb).eff_cap, cap))
Linus Torvalds1da177e2005-04-16 15:20:36 -070040 return -EPERM;
41 return 0;
42}
Linus Torvalds1da177e2005-04-16 15:20:36 -070043EXPORT_SYMBOL(cap_netlink_recv);
44
David Howells1d045982008-11-14 10:39:24 +110045/**
46 * cap_capable - Determine whether a task has a particular effective capability
47 * @tsk: The task to query
David Howells3699c532009-01-06 22:27:01 +000048 * @cred: The credentials to use
David Howells1d045982008-11-14 10:39:24 +110049 * @cap: The capability to check for
50 * @audit: Whether to write an audit message or not
51 *
52 * Determine whether the nominated task has the specified capability amongst
53 * its effective set, returning 0 if it does, -ve if it does not.
54 *
David Howells3699c532009-01-06 22:27:01 +000055 * NOTE WELL: cap_has_capability() cannot be used like the kernel's capable()
56 * and has_capability() functions. That is, it has the reverse semantics:
57 * cap_has_capability() returns 0 when a task has a capability, but the
58 * kernel's capable() and has_capability() returns 1 for this case.
Andrew G. Morgana6dbb1e2008-01-21 17:18:30 -080059 */
David Howells3699c532009-01-06 22:27:01 +000060int cap_capable(struct task_struct *tsk, const struct cred *cred, int cap,
61 int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -070062{
David Howells3699c532009-01-06 22:27:01 +000063 return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
Linus Torvalds1da177e2005-04-16 15:20:36 -070064}
65
David Howells1d045982008-11-14 10:39:24 +110066/**
67 * cap_settime - Determine whether the current process may set the system clock
68 * @ts: The time to set
69 * @tz: The timezone to set
70 *
71 * Determine whether the current process may set the system clock and timezone
72 * information, returning 0 if permission granted, -ve if denied.
73 */
Linus Torvalds1da177e2005-04-16 15:20:36 -070074int cap_settime(struct timespec *ts, struct timezone *tz)
75{
76 if (!capable(CAP_SYS_TIME))
77 return -EPERM;
78 return 0;
79}
80
David Howells1d045982008-11-14 10:39:24 +110081/**
82 * cap_ptrace_may_access - Determine whether the current process may access
83 * another
84 * @child: The process to be accessed
85 * @mode: The mode of attachment.
86 *
87 * Determine whether a process may access another, returning 0 if permission
88 * granted, -ve if denied.
89 */
David Howells5cd9c582008-08-14 11:37:28 +010090int cap_ptrace_may_access(struct task_struct *child, unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -070091{
David Howellsc69e8d92008-11-14 10:39:19 +110092 int ret = 0;
93
94 rcu_read_lock();
David Howellsd84f4f92008-11-14 10:39:23 +110095 if (!cap_issubset(__task_cred(child)->cap_permitted,
96 current_cred()->cap_permitted) &&
David Howellsc69e8d92008-11-14 10:39:19 +110097 !capable(CAP_SYS_PTRACE))
98 ret = -EPERM;
99 rcu_read_unlock();
100 return ret;
David Howells5cd9c582008-08-14 11:37:28 +0100101}
102
David Howells1d045982008-11-14 10:39:24 +1100103/**
104 * cap_ptrace_traceme - Determine whether another process may trace the current
105 * @parent: The task proposed to be the tracer
106 *
107 * Determine whether the nominated task is permitted to trace the current
108 * process, returning 0 if permission is granted, -ve if denied.
109 */
David Howells5cd9c582008-08-14 11:37:28 +0100110int cap_ptrace_traceme(struct task_struct *parent)
111{
David Howellsc69e8d92008-11-14 10:39:19 +1100112 int ret = 0;
113
114 rcu_read_lock();
David Howellsd84f4f92008-11-14 10:39:23 +1100115 if (!cap_issubset(current_cred()->cap_permitted,
116 __task_cred(parent)->cap_permitted) &&
David Howellsc69e8d92008-11-14 10:39:19 +1100117 !has_capability(parent, CAP_SYS_PTRACE))
118 ret = -EPERM;
119 rcu_read_unlock();
120 return ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700121}
122
David Howells1d045982008-11-14 10:39:24 +1100123/**
124 * cap_capget - Retrieve a task's capability sets
125 * @target: The task from which to retrieve the capability sets
126 * @effective: The place to record the effective set
127 * @inheritable: The place to record the inheritable set
128 * @permitted: The place to record the permitted set
129 *
130 * This function retrieves the capabilities of the nominated task and returns
131 * them to the caller.
132 */
133int cap_capget(struct task_struct *target, kernel_cap_t *effective,
134 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700135{
David Howellsc69e8d92008-11-14 10:39:19 +1100136 const struct cred *cred;
David Howellsb6dff3e2008-11-14 10:39:16 +1100137
Linus Torvalds1da177e2005-04-16 15:20:36 -0700138 /* Derived from kernel/capability.c:sys_capget. */
David Howellsc69e8d92008-11-14 10:39:19 +1100139 rcu_read_lock();
140 cred = __task_cred(target);
David Howellsb6dff3e2008-11-14 10:39:16 +1100141 *effective = cred->cap_effective;
142 *inheritable = cred->cap_inheritable;
143 *permitted = cred->cap_permitted;
David Howellsc69e8d92008-11-14 10:39:19 +1100144 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700145 return 0;
146}
147
David Howells1d045982008-11-14 10:39:24 +1100148/*
149 * Determine whether the inheritable capabilities are limited to the old
150 * permitted set. Returns 1 if they are limited, 0 if they are not.
151 */
Andrew Morgan72c2d582007-10-18 03:05:59 -0700152static inline int cap_inh_is_capped(void)
153{
David Howells1d045982008-11-14 10:39:24 +1100154#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
155
156 /* they are so limited unless the current task has the CAP_SETPCAP
157 * capability
Andrew Morgan72c2d582007-10-18 03:05:59 -0700158 */
David Howells3699c532009-01-06 22:27:01 +0000159 if (cap_capable(current, current_cred(), CAP_SETPCAP,
160 SECURITY_CAP_AUDIT) == 0)
David Howells1d045982008-11-14 10:39:24 +1100161 return 0;
162#endif
163 return 1;
Andrew Morgan72c2d582007-10-18 03:05:59 -0700164}
165
David Howells1d045982008-11-14 10:39:24 +1100166/**
167 * cap_capset - Validate and apply proposed changes to current's capabilities
168 * @new: The proposed new credentials; alterations should be made here
169 * @old: The current task's current credentials
170 * @effective: A pointer to the proposed new effective capabilities set
171 * @inheritable: A pointer to the proposed new inheritable capabilities set
172 * @permitted: A pointer to the proposed new permitted capabilities set
173 *
174 * This function validates and applies a proposed mass change to the current
175 * process's capability sets. The changes are made to the proposed new
176 * credentials, and assuming no error, will be committed by the caller of LSM.
177 */
David Howellsd84f4f92008-11-14 10:39:23 +1100178int cap_capset(struct cred *new,
179 const struct cred *old,
180 const kernel_cap_t *effective,
181 const kernel_cap_t *inheritable,
182 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700183{
David Howellsd84f4f92008-11-14 10:39:23 +1100184 if (cap_inh_is_capped() &&
185 !cap_issubset(*inheritable,
186 cap_combine(old->cap_inheritable,
187 old->cap_permitted)))
Andrew Morgan72c2d582007-10-18 03:05:59 -0700188 /* incapable of using this inheritable set */
Linus Torvalds1da177e2005-04-16 15:20:36 -0700189 return -EPERM;
David Howellsd84f4f92008-11-14 10:39:23 +1100190
Serge E. Hallyn3b7391d2008-02-04 22:29:45 -0800191 if (!cap_issubset(*inheritable,
David Howellsd84f4f92008-11-14 10:39:23 +1100192 cap_combine(old->cap_inheritable,
193 old->cap_bset)))
Serge E. Hallyn3b7391d2008-02-04 22:29:45 -0800194 /* no new pI capabilities outside bounding set */
195 return -EPERM;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700196
197 /* verify restrictions on target's new Permitted set */
David Howellsd84f4f92008-11-14 10:39:23 +1100198 if (!cap_issubset(*permitted, old->cap_permitted))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700199 return -EPERM;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700200
201 /* verify the _new_Effective_ is a subset of the _new_Permitted_ */
David Howellsd84f4f92008-11-14 10:39:23 +1100202 if (!cap_issubset(*effective, *permitted))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700203 return -EPERM;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700204
David Howellsd84f4f92008-11-14 10:39:23 +1100205 new->cap_effective = *effective;
206 new->cap_inheritable = *inheritable;
207 new->cap_permitted = *permitted;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700208 return 0;
209}
210
David Howells1d045982008-11-14 10:39:24 +1100211/*
212 * Clear proposed capability sets for execve().
213 */
Serge E. Hallynb5376772007-10-16 23:31:36 -0700214static inline void bprm_clear_caps(struct linux_binprm *bprm)
215{
David Howellsa6f76f22008-11-14 10:39:24 +1100216 cap_clear(bprm->cred->cap_permitted);
Serge E. Hallynb5376772007-10-16 23:31:36 -0700217 bprm->cap_effective = false;
218}
219
220#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
221
David Howells1d045982008-11-14 10:39:24 +1100222/**
223 * cap_inode_need_killpriv - Determine if inode change affects privileges
224 * @dentry: The inode/dentry in being changed with change marked ATTR_KILL_PRIV
225 *
226 * Determine if an inode having a change applied that's marked ATTR_KILL_PRIV
227 * affects the security markings on that inode, and if it is, should
228 * inode_killpriv() be invoked or the change rejected?
229 *
230 * Returns 0 if granted; +ve if granted, but inode_killpriv() is required; and
231 * -ve to deny the change.
232 */
Serge E. Hallynb5376772007-10-16 23:31:36 -0700233int cap_inode_need_killpriv(struct dentry *dentry)
234{
235 struct inode *inode = dentry->d_inode;
236 int error;
237
Al Viroacfa4382008-12-04 10:06:33 -0500238 if (!inode->i_op->getxattr)
Serge E. Hallynb5376772007-10-16 23:31:36 -0700239 return 0;
240
241 error = inode->i_op->getxattr(dentry, XATTR_NAME_CAPS, NULL, 0);
242 if (error <= 0)
243 return 0;
244 return 1;
245}
246
David Howells1d045982008-11-14 10:39:24 +1100247/**
248 * cap_inode_killpriv - Erase the security markings on an inode
249 * @dentry: The inode/dentry to alter
250 *
251 * Erase the privilege-enhancing security markings on an inode.
252 *
253 * Returns 0 if successful, -ve on error.
254 */
Serge E. Hallynb5376772007-10-16 23:31:36 -0700255int cap_inode_killpriv(struct dentry *dentry)
256{
257 struct inode *inode = dentry->d_inode;
258
Al Viroacfa4382008-12-04 10:06:33 -0500259 if (!inode->i_op->removexattr)
Serge E. Hallynb5376772007-10-16 23:31:36 -0700260 return 0;
261
262 return inode->i_op->removexattr(dentry, XATTR_NAME_CAPS);
263}
264
David Howells1d045982008-11-14 10:39:24 +1100265/*
266 * Calculate the new process capability sets from the capability sets attached
267 * to a file.
268 */
Eric Parisc0b00442008-11-11 21:48:10 +1100269static inline int bprm_caps_from_vfs_caps(struct cpu_vfs_cap_data *caps,
David Howellsa6f76f22008-11-14 10:39:24 +1100270 struct linux_binprm *bprm,
271 bool *effective)
Serge E. Hallynb5376772007-10-16 23:31:36 -0700272{
David Howellsa6f76f22008-11-14 10:39:24 +1100273 struct cred *new = bprm->cred;
Eric Parisc0b00442008-11-11 21:48:10 +1100274 unsigned i;
275 int ret = 0;
276
277 if (caps->magic_etc & VFS_CAP_FLAGS_EFFECTIVE)
David Howellsa6f76f22008-11-14 10:39:24 +1100278 *effective = true;
Eric Parisc0b00442008-11-11 21:48:10 +1100279
280 CAP_FOR_EACH_U32(i) {
281 __u32 permitted = caps->permitted.cap[i];
282 __u32 inheritable = caps->inheritable.cap[i];
283
284 /*
285 * pP' = (X & fP) | (pI & fI)
286 */
David Howellsa6f76f22008-11-14 10:39:24 +1100287 new->cap_permitted.cap[i] =
288 (new->cap_bset.cap[i] & permitted) |
289 (new->cap_inheritable.cap[i] & inheritable);
Eric Parisc0b00442008-11-11 21:48:10 +1100290
David Howellsa6f76f22008-11-14 10:39:24 +1100291 if (permitted & ~new->cap_permitted.cap[i])
292 /* insufficient to execute correctly */
Eric Parisc0b00442008-11-11 21:48:10 +1100293 ret = -EPERM;
Eric Parisc0b00442008-11-11 21:48:10 +1100294 }
295
296 /*
297 * For legacy apps, with no internal support for recognizing they
298 * do not have enough capabilities, we return an error if they are
299 * missing some "forced" (aka file-permitted) capabilities.
300 */
David Howellsa6f76f22008-11-14 10:39:24 +1100301 return *effective ? ret : 0;
Eric Parisc0b00442008-11-11 21:48:10 +1100302}
303
David Howells1d045982008-11-14 10:39:24 +1100304/*
305 * Extract the on-exec-apply capability sets for an executable file.
306 */
Eric Parisc0b00442008-11-11 21:48:10 +1100307int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps)
308{
309 struct inode *inode = dentry->d_inode;
Serge E. Hallynb5376772007-10-16 23:31:36 -0700310 __u32 magic_etc;
Andrew Morgane338d262008-02-04 22:29:42 -0800311 unsigned tocopy, i;
Eric Parisc0b00442008-11-11 21:48:10 +1100312 int size;
313 struct vfs_cap_data caps;
314
315 memset(cpu_caps, 0, sizeof(struct cpu_vfs_cap_data));
316
Al Viroacfa4382008-12-04 10:06:33 -0500317 if (!inode || !inode->i_op->getxattr)
Eric Parisc0b00442008-11-11 21:48:10 +1100318 return -ENODATA;
319
320 size = inode->i_op->getxattr((struct dentry *)dentry, XATTR_NAME_CAPS, &caps,
321 XATTR_CAPS_SZ);
David Howellsa6f76f22008-11-14 10:39:24 +1100322 if (size == -ENODATA || size == -EOPNOTSUPP)
Eric Parisc0b00442008-11-11 21:48:10 +1100323 /* no data, that's ok */
324 return -ENODATA;
Eric Parisc0b00442008-11-11 21:48:10 +1100325 if (size < 0)
326 return size;
Serge E. Hallynb5376772007-10-16 23:31:36 -0700327
Andrew Morgane338d262008-02-04 22:29:42 -0800328 if (size < sizeof(magic_etc))
Serge E. Hallynb5376772007-10-16 23:31:36 -0700329 return -EINVAL;
330
Eric Parisc0b00442008-11-11 21:48:10 +1100331 cpu_caps->magic_etc = magic_etc = le32_to_cpu(caps.magic_etc);
Serge E. Hallynb5376772007-10-16 23:31:36 -0700332
David Howellsa6f76f22008-11-14 10:39:24 +1100333 switch (magic_etc & VFS_CAP_REVISION_MASK) {
Andrew Morgane338d262008-02-04 22:29:42 -0800334 case VFS_CAP_REVISION_1:
335 if (size != XATTR_CAPS_SZ_1)
336 return -EINVAL;
337 tocopy = VFS_CAP_U32_1;
338 break;
339 case VFS_CAP_REVISION_2:
340 if (size != XATTR_CAPS_SZ_2)
341 return -EINVAL;
342 tocopy = VFS_CAP_U32_2;
343 break;
Serge E. Hallynb5376772007-10-16 23:31:36 -0700344 default:
345 return -EINVAL;
346 }
Andrew Morgane338d262008-02-04 22:29:42 -0800347
Andrew G. Morgan5459c162008-07-23 21:28:24 -0700348 CAP_FOR_EACH_U32(i) {
Eric Parisc0b00442008-11-11 21:48:10 +1100349 if (i >= tocopy)
350 break;
351 cpu_caps->permitted.cap[i] = le32_to_cpu(caps.data[i].permitted);
352 cpu_caps->inheritable.cap[i] = le32_to_cpu(caps.data[i].inheritable);
Andrew Morgane338d262008-02-04 22:29:42 -0800353 }
David Howellsa6f76f22008-11-14 10:39:24 +1100354
Eric Parisc0b00442008-11-11 21:48:10 +1100355 return 0;
Serge E. Hallynb5376772007-10-16 23:31:36 -0700356}
357
David Howells1d045982008-11-14 10:39:24 +1100358/*
359 * Attempt to get the on-exec apply capability sets for an executable file from
360 * its xattrs and, if present, apply them to the proposed credentials being
361 * constructed by execve().
362 */
David Howellsa6f76f22008-11-14 10:39:24 +1100363static int get_file_caps(struct linux_binprm *bprm, bool *effective)
Serge E. Hallynb5376772007-10-16 23:31:36 -0700364{
365 struct dentry *dentry;
366 int rc = 0;
Eric Parisc0b00442008-11-11 21:48:10 +1100367 struct cpu_vfs_cap_data vcaps;
Serge E. Hallynb5376772007-10-16 23:31:36 -0700368
Serge Hallyn3318a382008-10-30 11:52:23 -0500369 bprm_clear_caps(bprm);
370
Serge E. Hallyn1f29fae2008-11-05 16:08:52 -0600371 if (!file_caps_enabled)
372 return 0;
373
Serge Hallyn3318a382008-10-30 11:52:23 -0500374 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
Serge E. Hallynb5376772007-10-16 23:31:36 -0700375 return 0;
Serge E. Hallynb5376772007-10-16 23:31:36 -0700376
377 dentry = dget(bprm->file->f_dentry);
Serge E. Hallynb5376772007-10-16 23:31:36 -0700378
Eric Parisc0b00442008-11-11 21:48:10 +1100379 rc = get_vfs_caps_from_disk(dentry, &vcaps);
380 if (rc < 0) {
381 if (rc == -EINVAL)
382 printk(KERN_NOTICE "%s: get_vfs_caps_from_disk returned %d for %s\n",
383 __func__, rc, bprm->filename);
384 else if (rc == -ENODATA)
385 rc = 0;
Serge E. Hallynb5376772007-10-16 23:31:36 -0700386 goto out;
387 }
Serge E. Hallynb5376772007-10-16 23:31:36 -0700388
David Howellsa6f76f22008-11-14 10:39:24 +1100389 rc = bprm_caps_from_vfs_caps(&vcaps, bprm, effective);
390 if (rc == -EINVAL)
391 printk(KERN_NOTICE "%s: cap_from_disk returned %d for %s\n",
392 __func__, rc, bprm->filename);
Serge E. Hallynb5376772007-10-16 23:31:36 -0700393
394out:
395 dput(dentry);
396 if (rc)
397 bprm_clear_caps(bprm);
398
399 return rc;
400}
401
402#else
403int cap_inode_need_killpriv(struct dentry *dentry)
404{
405 return 0;
406}
407
408int cap_inode_killpriv(struct dentry *dentry)
409{
410 return 0;
411}
412
Eric Parise50a9062008-11-13 18:37:25 -0500413int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps)
414{
415 memset(cpu_caps, 0, sizeof(struct cpu_vfs_cap_data));
416 return -ENODATA;
417}
418
David Howellsa6f76f22008-11-14 10:39:24 +1100419static inline int get_file_caps(struct linux_binprm *bprm, bool *effective)
Serge E. Hallynb5376772007-10-16 23:31:36 -0700420{
421 bprm_clear_caps(bprm);
422 return 0;
423}
424#endif
425
David Howellsa6f76f22008-11-14 10:39:24 +1100426/*
David Howells1d045982008-11-14 10:39:24 +1100427 * Determine whether a exec'ing process's new permitted capabilities should be
428 * limited to just what it already has.
429 *
430 * This prevents processes that are being ptraced from gaining access to
431 * CAP_SETPCAP, unless the process they're tracing already has it, and the
432 * binary they're executing has filecaps that elevate it.
433 *
434 * Returns 1 if they should be limited, 0 if they are not.
435 */
436static inline int cap_limit_ptraced_target(void)
437{
438#ifndef CONFIG_SECURITY_FILE_CAPABILITIES
439 if (capable(CAP_SETPCAP))
440 return 0;
441#endif
442 return 1;
443}
444
445/**
446 * cap_bprm_set_creds - Set up the proposed credentials for execve().
447 * @bprm: The execution parameters, including the proposed creds
448 *
449 * Set up the proposed credentials for a new execution context being
450 * constructed by execve(). The proposed creds in @bprm->cred is altered,
451 * which won't take effect immediately. Returns 0 if successful, -ve on error.
David Howellsa6f76f22008-11-14 10:39:24 +1100452 */
453int cap_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700454{
David Howellsa6f76f22008-11-14 10:39:24 +1100455 const struct cred *old = current_cred();
456 struct cred *new = bprm->cred;
457 bool effective;
Serge E. Hallynb5376772007-10-16 23:31:36 -0700458 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700459
David Howellsa6f76f22008-11-14 10:39:24 +1100460 effective = false;
461 ret = get_file_caps(bprm, &effective);
462 if (ret < 0)
463 return ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700464
Andrew G. Morgan5459c162008-07-23 21:28:24 -0700465 if (!issecure(SECURE_NOROOT)) {
466 /*
467 * To support inheritance of root-permissions and suid-root
468 * executables under compatibility mode, we override the
469 * capability sets for the file.
470 *
David Howellsa6f76f22008-11-14 10:39:24 +1100471 * If only the real uid is 0, we do not set the effective bit.
Andrew G. Morgan5459c162008-07-23 21:28:24 -0700472 */
David Howellsa6f76f22008-11-14 10:39:24 +1100473 if (new->euid == 0 || new->uid == 0) {
Andrew G. Morgan5459c162008-07-23 21:28:24 -0700474 /* pP' = (cap_bset & ~0) | (pI & ~0) */
David Howellsa6f76f22008-11-14 10:39:24 +1100475 new->cap_permitted = cap_combine(old->cap_bset,
476 old->cap_inheritable);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700477 }
David Howellsa6f76f22008-11-14 10:39:24 +1100478 if (new->euid == 0)
479 effective = true;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700480 }
Serge E. Hallynb5376772007-10-16 23:31:36 -0700481
David Howellsa6f76f22008-11-14 10:39:24 +1100482 /* Don't let someone trace a set[ug]id/setpcap binary with the revised
483 * credentials unless they have the appropriate permit
484 */
485 if ((new->euid != old->uid ||
486 new->egid != old->gid ||
487 !cap_issubset(new->cap_permitted, old->cap_permitted)) &&
488 bprm->unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
489 /* downgrade; they get no more than they had, and maybe less */
490 if (!capable(CAP_SETUID)) {
491 new->euid = new->uid;
492 new->egid = new->gid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700493 }
David Howellsa6f76f22008-11-14 10:39:24 +1100494 if (cap_limit_ptraced_target())
495 new->cap_permitted = cap_intersect(new->cap_permitted,
496 old->cap_permitted);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700497 }
498
David Howellsa6f76f22008-11-14 10:39:24 +1100499 new->suid = new->fsuid = new->euid;
500 new->sgid = new->fsgid = new->egid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700501
David Howellsa6f76f22008-11-14 10:39:24 +1100502 /* For init, we want to retain the capabilities set in the initial
503 * task. Thus we skip the usual capability rules
504 */
Serge E. Hallynb460cbc2007-10-18 23:39:52 -0700505 if (!is_global_init(current)) {
David Howellsa6f76f22008-11-14 10:39:24 +1100506 if (effective)
507 new->cap_effective = new->cap_permitted;
Andrew Morgane338d262008-02-04 22:29:42 -0800508 else
David Howellsd84f4f92008-11-14 10:39:23 +1100509 cap_clear(new->cap_effective);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700510 }
David Howellsa6f76f22008-11-14 10:39:24 +1100511 bprm->cap_effective = effective;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700512
Eric Paris3fc689e2008-11-11 21:48:18 +1100513 /*
514 * Audit candidate if current->cap_effective is set
515 *
516 * We do not bother to audit if 3 things are true:
517 * 1) cap_effective has all caps
518 * 2) we are root
519 * 3) root is supposed to have all caps (SECURE_NOROOT)
520 * Since this is just a normal root execing a process.
521 *
522 * Number 1 above might fail if you don't have a full bset, but I think
523 * that is interesting information to audit.
524 */
David Howellsd84f4f92008-11-14 10:39:23 +1100525 if (!cap_isclear(new->cap_effective)) {
526 if (!cap_issubset(CAP_FULL_SET, new->cap_effective) ||
David Howellsa6f76f22008-11-14 10:39:24 +1100527 new->euid != 0 || new->uid != 0 ||
528 issecure(SECURE_NOROOT)) {
529 ret = audit_log_bprm_fcaps(bprm, new, old);
530 if (ret < 0)
531 return ret;
532 }
Eric Paris3fc689e2008-11-11 21:48:18 +1100533 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700534
David Howellsd84f4f92008-11-14 10:39:23 +1100535 new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
David Howellsa6f76f22008-11-14 10:39:24 +1100536 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700537}
538
David Howells1d045982008-11-14 10:39:24 +1100539/**
540 * cap_bprm_secureexec - Determine whether a secure execution is required
541 * @bprm: The execution parameters
542 *
543 * Determine whether a secure execution is required, return 1 if it is, and 0
544 * if it is not.
545 *
546 * The credentials have been committed by this point, and so are no longer
547 * available through @bprm->cred.
David Howellsa6f76f22008-11-14 10:39:24 +1100548 */
549int cap_bprm_secureexec(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700550{
David Howellsc69e8d92008-11-14 10:39:19 +1100551 const struct cred *cred = current_cred();
David Howellsb6dff3e2008-11-14 10:39:16 +1100552
553 if (cred->uid != 0) {
Serge E. Hallynb5376772007-10-16 23:31:36 -0700554 if (bprm->cap_effective)
555 return 1;
David Howellsa6f76f22008-11-14 10:39:24 +1100556 if (!cap_isclear(cred->cap_permitted))
Serge E. Hallynb5376772007-10-16 23:31:36 -0700557 return 1;
558 }
559
David Howellsb6dff3e2008-11-14 10:39:16 +1100560 return (cred->euid != cred->uid ||
561 cred->egid != cred->gid);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700562}
563
David Howells1d045982008-11-14 10:39:24 +1100564/**
565 * cap_inode_setxattr - Determine whether an xattr may be altered
566 * @dentry: The inode/dentry being altered
567 * @name: The name of the xattr to be changed
568 * @value: The value that the xattr will be changed to
569 * @size: The size of value
570 * @flags: The replacement flag
571 *
572 * Determine whether an xattr may be altered or set on an inode, returning 0 if
573 * permission is granted, -ve if denied.
574 *
575 * This is used to make sure security xattrs don't get updated or set by those
576 * who aren't privileged to do so.
577 */
David Howells8f0cfa52008-04-29 00:59:41 -0700578int cap_inode_setxattr(struct dentry *dentry, const char *name,
579 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700580{
Serge E. Hallynb5376772007-10-16 23:31:36 -0700581 if (!strcmp(name, XATTR_NAME_CAPS)) {
582 if (!capable(CAP_SETFCAP))
583 return -EPERM;
584 return 0;
David Howells1d045982008-11-14 10:39:24 +1100585 }
586
587 if (!strncmp(name, XATTR_SECURITY_PREFIX,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700588 sizeof(XATTR_SECURITY_PREFIX) - 1) &&
589 !capable(CAP_SYS_ADMIN))
590 return -EPERM;
591 return 0;
592}
593
David Howells1d045982008-11-14 10:39:24 +1100594/**
595 * cap_inode_removexattr - Determine whether an xattr may be removed
596 * @dentry: The inode/dentry being altered
597 * @name: The name of the xattr to be changed
598 *
599 * Determine whether an xattr may be removed from an inode, returning 0 if
600 * permission is granted, -ve if denied.
601 *
602 * This is used to make sure security xattrs don't get removed by those who
603 * aren't privileged to remove them.
604 */
David Howells8f0cfa52008-04-29 00:59:41 -0700605int cap_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700606{
Serge E. Hallynb5376772007-10-16 23:31:36 -0700607 if (!strcmp(name, XATTR_NAME_CAPS)) {
608 if (!capable(CAP_SETFCAP))
609 return -EPERM;
610 return 0;
David Howells1d045982008-11-14 10:39:24 +1100611 }
612
613 if (!strncmp(name, XATTR_SECURITY_PREFIX,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700614 sizeof(XATTR_SECURITY_PREFIX) - 1) &&
615 !capable(CAP_SYS_ADMIN))
616 return -EPERM;
617 return 0;
618}
619
David Howellsa6f76f22008-11-14 10:39:24 +1100620/*
Linus Torvalds1da177e2005-04-16 15:20:36 -0700621 * cap_emulate_setxuid() fixes the effective / permitted capabilities of
622 * a process after a call to setuid, setreuid, or setresuid.
623 *
624 * 1) When set*uiding _from_ one of {r,e,s}uid == 0 _to_ all of
625 * {r,e,s}uid != 0, the permitted and effective capabilities are
626 * cleared.
627 *
628 * 2) When set*uiding _from_ euid == 0 _to_ euid != 0, the effective
629 * capabilities of the process are cleared.
630 *
631 * 3) When set*uiding _from_ euid != 0 _to_ euid == 0, the effective
632 * capabilities are set to the permitted capabilities.
633 *
David Howellsa6f76f22008-11-14 10:39:24 +1100634 * fsuid is handled elsewhere. fsuid == 0 and {r,e,s}uid!= 0 should
Linus Torvalds1da177e2005-04-16 15:20:36 -0700635 * never happen.
636 *
David Howellsa6f76f22008-11-14 10:39:24 +1100637 * -astor
Linus Torvalds1da177e2005-04-16 15:20:36 -0700638 *
639 * cevans - New behaviour, Oct '99
640 * A process may, via prctl(), elect to keep its capabilities when it
641 * calls setuid() and switches away from uid==0. Both permitted and
642 * effective sets will be retained.
643 * Without this change, it was impossible for a daemon to drop only some
644 * of its privilege. The call to setuid(!=0) would drop all privileges!
645 * Keeping uid 0 is not an option because uid 0 owns too many vital
646 * files..
647 * Thanks to Olaf Kirch and Peter Benie for spotting this.
648 */
David Howellsd84f4f92008-11-14 10:39:23 +1100649static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700650{
David Howellsd84f4f92008-11-14 10:39:23 +1100651 if ((old->uid == 0 || old->euid == 0 || old->suid == 0) &&
652 (new->uid != 0 && new->euid != 0 && new->suid != 0) &&
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700653 !issecure(SECURE_KEEP_CAPS)) {
David Howellsd84f4f92008-11-14 10:39:23 +1100654 cap_clear(new->cap_permitted);
655 cap_clear(new->cap_effective);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700656 }
David Howellsd84f4f92008-11-14 10:39:23 +1100657 if (old->euid == 0 && new->euid != 0)
658 cap_clear(new->cap_effective);
659 if (old->euid != 0 && new->euid == 0)
660 new->cap_effective = new->cap_permitted;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700661}
662
David Howells1d045982008-11-14 10:39:24 +1100663/**
664 * cap_task_fix_setuid - Fix up the results of setuid() call
665 * @new: The proposed credentials
666 * @old: The current task's current credentials
667 * @flags: Indications of what has changed
668 *
669 * Fix up the results of setuid() call before the credential changes are
670 * actually applied, returning 0 to grant the changes, -ve to deny them.
671 */
David Howellsd84f4f92008-11-14 10:39:23 +1100672int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700673{
674 switch (flags) {
675 case LSM_SETID_RE:
676 case LSM_SETID_ID:
677 case LSM_SETID_RES:
David Howells1d045982008-11-14 10:39:24 +1100678 /* juggle the capabilities to follow [RES]UID changes unless
679 * otherwise suppressed */
David Howellsd84f4f92008-11-14 10:39:23 +1100680 if (!issecure(SECURE_NO_SETUID_FIXUP))
681 cap_emulate_setxuid(new, old);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700682 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700683
David Howells1d045982008-11-14 10:39:24 +1100684 case LSM_SETID_FS:
685 /* juggle the capabilties to follow FSUID changes, unless
686 * otherwise suppressed
687 *
David Howellsd84f4f92008-11-14 10:39:23 +1100688 * FIXME - is fsuser used for all CAP_FS_MASK capabilities?
689 * if not, we might be a bit too harsh here.
690 */
691 if (!issecure(SECURE_NO_SETUID_FIXUP)) {
David Howells1d045982008-11-14 10:39:24 +1100692 if (old->fsuid == 0 && new->fsuid != 0)
David Howellsd84f4f92008-11-14 10:39:23 +1100693 new->cap_effective =
694 cap_drop_fs_set(new->cap_effective);
David Howells1d045982008-11-14 10:39:24 +1100695
696 if (old->fsuid != 0 && new->fsuid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +1100697 new->cap_effective =
698 cap_raise_fs_set(new->cap_effective,
699 new->cap_permitted);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700700 }
David Howellsd84f4f92008-11-14 10:39:23 +1100701 break;
David Howells1d045982008-11-14 10:39:24 +1100702
Linus Torvalds1da177e2005-04-16 15:20:36 -0700703 default:
704 return -EINVAL;
705 }
706
707 return 0;
708}
709
Serge E. Hallynb5376772007-10-16 23:31:36 -0700710#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
711/*
712 * Rationale: code calling task_setscheduler, task_setioprio, and
713 * task_setnice, assumes that
714 * . if capable(cap_sys_nice), then those actions should be allowed
715 * . if not capable(cap_sys_nice), but acting on your own processes,
716 * then those actions should be allowed
717 * This is insufficient now since you can call code without suid, but
718 * yet with increased caps.
719 * So we check for increased caps on the target process.
720 */
Serge E. Hallynde45e802008-09-26 22:27:47 -0400721static int cap_safe_nice(struct task_struct *p)
Serge E. Hallynb5376772007-10-16 23:31:36 -0700722{
David Howellsc69e8d92008-11-14 10:39:19 +1100723 int is_subset;
724
725 rcu_read_lock();
726 is_subset = cap_issubset(__task_cred(p)->cap_permitted,
727 current_cred()->cap_permitted);
728 rcu_read_unlock();
729
730 if (!is_subset && !capable(CAP_SYS_NICE))
Serge E. Hallynb5376772007-10-16 23:31:36 -0700731 return -EPERM;
732 return 0;
733}
734
David Howells1d045982008-11-14 10:39:24 +1100735/**
736 * cap_task_setscheduler - Detemine if scheduler policy change is permitted
737 * @p: The task to affect
738 * @policy: The policy to effect
739 * @lp: The parameters to the scheduling policy
740 *
741 * Detemine if the requested scheduler policy change is permitted for the
742 * specified task, returning 0 if permission is granted, -ve if denied.
743 */
744int cap_task_setscheduler(struct task_struct *p, int policy,
Serge E. Hallynb5376772007-10-16 23:31:36 -0700745 struct sched_param *lp)
746{
747 return cap_safe_nice(p);
748}
749
David Howells1d045982008-11-14 10:39:24 +1100750/**
751 * cap_task_ioprio - Detemine if I/O priority change is permitted
752 * @p: The task to affect
753 * @ioprio: The I/O priority to set
754 *
755 * Detemine if the requested I/O priority change is permitted for the specified
756 * task, returning 0 if permission is granted, -ve if denied.
757 */
758int cap_task_setioprio(struct task_struct *p, int ioprio)
Serge E. Hallynb5376772007-10-16 23:31:36 -0700759{
760 return cap_safe_nice(p);
761}
762
David Howells1d045982008-11-14 10:39:24 +1100763/**
764 * cap_task_ioprio - Detemine if task priority change is permitted
765 * @p: The task to affect
766 * @nice: The nice value to set
767 *
768 * Detemine if the requested task priority change is permitted for the
769 * specified task, returning 0 if permission is granted, -ve if denied.
770 */
771int cap_task_setnice(struct task_struct *p, int nice)
Serge E. Hallynb5376772007-10-16 23:31:36 -0700772{
773 return cap_safe_nice(p);
774}
775
Serge E. Hallyn3b7391d2008-02-04 22:29:45 -0800776/*
David Howells1d045982008-11-14 10:39:24 +1100777 * Implement PR_CAPBSET_DROP. Attempt to remove the specified capability from
778 * the current task's bounding set. Returns 0 on success, -ve on error.
Serge E. Hallyn3b7391d2008-02-04 22:29:45 -0800779 */
David Howellsd84f4f92008-11-14 10:39:23 +1100780static long cap_prctl_drop(struct cred *new, unsigned long cap)
Serge E. Hallyn3b7391d2008-02-04 22:29:45 -0800781{
782 if (!capable(CAP_SETPCAP))
783 return -EPERM;
784 if (!cap_valid(cap))
785 return -EINVAL;
David Howellsd84f4f92008-11-14 10:39:23 +1100786
787 cap_lower(new->cap_bset, cap);
Serge E. Hallyn3b7391d2008-02-04 22:29:45 -0800788 return 0;
789}
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700790
Serge E. Hallynb5376772007-10-16 23:31:36 -0700791#else
792int cap_task_setscheduler (struct task_struct *p, int policy,
793 struct sched_param *lp)
794{
795 return 0;
796}
797int cap_task_setioprio (struct task_struct *p, int ioprio)
798{
799 return 0;
800}
801int cap_task_setnice (struct task_struct *p, int nice)
802{
803 return 0;
804}
Serge E. Hallynb5376772007-10-16 23:31:36 -0700805#endif
806
David Howells1d045982008-11-14 10:39:24 +1100807/**
808 * cap_task_prctl - Implement process control functions for this security module
809 * @option: The process control function requested
810 * @arg2, @arg3, @arg4, @arg5: The argument data for this function
811 *
812 * Allow process control functions (sys_prctl()) to alter capabilities; may
813 * also deny access to other functions not otherwise implemented here.
814 *
815 * Returns 0 or +ve on success, -ENOSYS if this function is not implemented
816 * here, other -ve on error. If -ENOSYS is returned, sys_prctl() and other LSM
817 * modules will consider performing the function.
818 */
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700819int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
David Howellsd84f4f92008-11-14 10:39:23 +1100820 unsigned long arg4, unsigned long arg5)
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700821{
David Howellsd84f4f92008-11-14 10:39:23 +1100822 struct cred *new;
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700823 long error = 0;
824
David Howellsd84f4f92008-11-14 10:39:23 +1100825 new = prepare_creds();
826 if (!new)
827 return -ENOMEM;
828
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700829 switch (option) {
830 case PR_CAPBSET_READ:
David Howellsd84f4f92008-11-14 10:39:23 +1100831 error = -EINVAL;
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700832 if (!cap_valid(arg2))
David Howellsd84f4f92008-11-14 10:39:23 +1100833 goto error;
834 error = !!cap_raised(new->cap_bset, arg2);
835 goto no_change;
836
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700837#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
838 case PR_CAPBSET_DROP:
David Howellsd84f4f92008-11-14 10:39:23 +1100839 error = cap_prctl_drop(new, arg2);
840 if (error < 0)
841 goto error;
842 goto changed;
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700843
844 /*
845 * The next four prctl's remain to assist with transitioning a
846 * system from legacy UID=0 based privilege (when filesystem
847 * capabilities are not in use) to a system using filesystem
848 * capabilities only - as the POSIX.1e draft intended.
849 *
850 * Note:
851 *
852 * PR_SET_SECUREBITS =
853 * issecure_mask(SECURE_KEEP_CAPS_LOCKED)
854 * | issecure_mask(SECURE_NOROOT)
855 * | issecure_mask(SECURE_NOROOT_LOCKED)
856 * | issecure_mask(SECURE_NO_SETUID_FIXUP)
857 * | issecure_mask(SECURE_NO_SETUID_FIXUP_LOCKED)
858 *
859 * will ensure that the current process and all of its
860 * children will be locked into a pure
861 * capability-based-privilege environment.
862 */
863 case PR_SET_SECUREBITS:
David Howellsd84f4f92008-11-14 10:39:23 +1100864 error = -EPERM;
865 if ((((new->securebits & SECURE_ALL_LOCKS) >> 1)
866 & (new->securebits ^ arg2)) /*[1]*/
867 || ((new->securebits & SECURE_ALL_LOCKS & ~arg2)) /*[2]*/
868 || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS)) /*[3]*/
David Howells3699c532009-01-06 22:27:01 +0000869 || (cap_capable(current, current_cred(), CAP_SETPCAP,
870 SECURITY_CAP_AUDIT) != 0) /*[4]*/
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700871 /*
872 * [1] no changing of bits that are locked
873 * [2] no unlocking of locks
874 * [3] no setting of unsupported bits
875 * [4] doing anything requires privilege (go read about
876 * the "sendmail capabilities bug")
877 */
David Howellsd84f4f92008-11-14 10:39:23 +1100878 )
879 /* cannot change a locked bit */
880 goto error;
881 new->securebits = arg2;
882 goto changed;
883
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700884 case PR_GET_SECUREBITS:
David Howellsd84f4f92008-11-14 10:39:23 +1100885 error = new->securebits;
886 goto no_change;
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700887
888#endif /* def CONFIG_SECURITY_FILE_CAPABILITIES */
889
890 case PR_GET_KEEPCAPS:
891 if (issecure(SECURE_KEEP_CAPS))
892 error = 1;
David Howellsd84f4f92008-11-14 10:39:23 +1100893 goto no_change;
894
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700895 case PR_SET_KEEPCAPS:
David Howellsd84f4f92008-11-14 10:39:23 +1100896 error = -EINVAL;
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700897 if (arg2 > 1) /* Note, we rely on arg2 being unsigned here */
David Howellsd84f4f92008-11-14 10:39:23 +1100898 goto error;
899 error = -EPERM;
900 if (issecure(SECURE_KEEP_CAPS_LOCKED))
901 goto error;
902 if (arg2)
903 new->securebits |= issecure_mask(SECURE_KEEP_CAPS);
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700904 else
David Howellsd84f4f92008-11-14 10:39:23 +1100905 new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
906 goto changed;
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700907
908 default:
909 /* No functionality available - continue with default */
David Howellsd84f4f92008-11-14 10:39:23 +1100910 error = -ENOSYS;
911 goto error;
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700912 }
913
914 /* Functionality provided */
David Howellsd84f4f92008-11-14 10:39:23 +1100915changed:
916 return commit_creds(new);
Andrew G. Morgan3898b1b2008-04-28 02:13:40 -0700917
David Howellsd84f4f92008-11-14 10:39:23 +1100918no_change:
David Howellsd84f4f92008-11-14 10:39:23 +1100919error:
920 abort_creds(new);
921 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700922}
923
David Howells1d045982008-11-14 10:39:24 +1100924/**
925 * cap_syslog - Determine whether syslog function is permitted
926 * @type: Function requested
927 *
928 * Determine whether the current process is permitted to use a particular
929 * syslog function, returning 0 if permission is granted, -ve if not.
930 */
931int cap_syslog(int type)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700932{
933 if ((type != 3 && type != 10) && !capable(CAP_SYS_ADMIN))
934 return -EPERM;
935 return 0;
936}
937
David Howells1d045982008-11-14 10:39:24 +1100938/**
939 * cap_vm_enough_memory - Determine whether a new virtual mapping is permitted
940 * @mm: The VM space in which the new mapping is to be made
941 * @pages: The size of the mapping
942 *
943 * Determine whether the allocation of a new virtual mapping by the current
944 * task is permitted, returning 0 if permission is granted, -ve if not.
945 */
Alan Cox34b4e4a2007-08-22 14:01:28 -0700946int cap_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700947{
948 int cap_sys_admin = 0;
949
David Howells3699c532009-01-06 22:27:01 +0000950 if (cap_capable(current, current_cred(), CAP_SYS_ADMIN,
951 SECURITY_CAP_NOAUDIT) == 0)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700952 cap_sys_admin = 1;
Alan Cox34b4e4a2007-08-22 14:01:28 -0700953 return __vm_enough_memory(mm, pages, cap_sys_admin);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700954}