Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * This is <linux/capability.h> |
| 3 | * |
Serge E. Hallyn | b537677 | 2007-10-16 23:31:36 -0700 | [diff] [blame] | 4 | * Andrew G. Morgan <morgan@kernel.org> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 5 | * Alexander Kjeldaas <astor@guardian.no> |
| 6 | * with help from Aleph1, Roland Buresund and Andrew Main. |
| 7 | * |
| 8 | * See here for the libcap library ("POSIX draft" compliance): |
| 9 | * |
GeunSik Lim | bcf5644 | 2009-06-16 10:26:25 +0200 | [diff] [blame] | 10 | * ftp://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.6/ |
Serge E. Hallyn | b537677 | 2007-10-16 23:31:36 -0700 | [diff] [blame] | 11 | */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 12 | |
| 13 | #ifndef _LINUX_CAPABILITY_H |
| 14 | #define _LINUX_CAPABILITY_H |
| 15 | |
| 16 | #include <linux/types.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 17 | |
Andrew Morton | b7add02 | 2007-05-23 13:57:39 -0700 | [diff] [blame] | 18 | struct task_struct; |
| 19 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 20 | /* User-level do most of the mapping between kernel and user |
| 21 | capabilities based on the version tag given by the kernel. The |
| 22 | kernel might be somewhat backwards compatible, but don't bet on |
| 23 | it. */ |
| 24 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 25 | /* Note, cap_t, is defined by POSIX (draft) to be an "opaque" pointer to |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 26 | a set of three capability sets. The transposition of 3*the |
| 27 | following structure to such a composite is better handled in a user |
| 28 | library since the draft standard requires the use of malloc/free |
| 29 | etc.. */ |
Serge E. Hallyn | b537677 | 2007-10-16 23:31:36 -0700 | [diff] [blame] | 30 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 31 | #define _LINUX_CAPABILITY_VERSION_1 0x19980330 |
| 32 | #define _LINUX_CAPABILITY_U32S_1 1 |
| 33 | |
Andrew G. Morgan | ca05a99 | 2008-05-27 22:05:17 -0700 | [diff] [blame] | 34 | #define _LINUX_CAPABILITY_VERSION_2 0x20071026 /* deprecated - use v3 */ |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 35 | #define _LINUX_CAPABILITY_U32S_2 2 |
| 36 | |
Andrew G. Morgan | ca05a99 | 2008-05-27 22:05:17 -0700 | [diff] [blame] | 37 | #define _LINUX_CAPABILITY_VERSION_3 0x20080522 |
| 38 | #define _LINUX_CAPABILITY_U32S_3 2 |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 39 | |
| 40 | typedef struct __user_cap_header_struct { |
| 41 | __u32 version; |
| 42 | int pid; |
| 43 | } __user *cap_user_header_t; |
Serge E. Hallyn | b537677 | 2007-10-16 23:31:36 -0700 | [diff] [blame] | 44 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 45 | typedef struct __user_cap_data_struct { |
| 46 | __u32 effective; |
| 47 | __u32 permitted; |
| 48 | __u32 inheritable; |
| 49 | } __user *cap_user_data_t; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 50 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 51 | |
Serge E. Hallyn | b537677 | 2007-10-16 23:31:36 -0700 | [diff] [blame] | 52 | #define VFS_CAP_REVISION_MASK 0xFF000000 |
Eric Paris | 851f7ff | 2008-11-11 21:48:14 +1100 | [diff] [blame] | 53 | #define VFS_CAP_REVISION_SHIFT 24 |
Serge E. Hallyn | b537677 | 2007-10-16 23:31:36 -0700 | [diff] [blame] | 54 | #define VFS_CAP_FLAGS_MASK ~VFS_CAP_REVISION_MASK |
| 55 | #define VFS_CAP_FLAGS_EFFECTIVE 0x000001 |
| 56 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 57 | #define VFS_CAP_REVISION_1 0x01000000 |
| 58 | #define VFS_CAP_U32_1 1 |
| 59 | #define XATTR_CAPS_SZ_1 (sizeof(__le32)*(1 + 2*VFS_CAP_U32_1)) |
| 60 | |
| 61 | #define VFS_CAP_REVISION_2 0x02000000 |
| 62 | #define VFS_CAP_U32_2 2 |
| 63 | #define XATTR_CAPS_SZ_2 (sizeof(__le32)*(1 + 2*VFS_CAP_U32_2)) |
| 64 | |
| 65 | #define XATTR_CAPS_SZ XATTR_CAPS_SZ_2 |
| 66 | #define VFS_CAP_U32 VFS_CAP_U32_2 |
| 67 | #define VFS_CAP_REVISION VFS_CAP_REVISION_2 |
| 68 | |
Serge E. Hallyn | b537677 | 2007-10-16 23:31:36 -0700 | [diff] [blame] | 69 | struct vfs_cap_data { |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 70 | __le32 magic_etc; /* Little endian */ |
Andrew Morton | 8f6936f | 2008-02-04 22:29:41 -0800 | [diff] [blame] | 71 | struct { |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 72 | __le32 permitted; /* Little endian */ |
| 73 | __le32 inheritable; /* Little endian */ |
| 74 | } data[VFS_CAP_U32]; |
Serge E. Hallyn | b537677 | 2007-10-16 23:31:36 -0700 | [diff] [blame] | 75 | }; |
| 76 | |
Andrew G. Morgan | ca05a99 | 2008-05-27 22:05:17 -0700 | [diff] [blame] | 77 | #ifndef __KERNEL__ |
| 78 | |
| 79 | /* |
| 80 | * Backwardly compatible definition for source code - trapped in a |
| 81 | * 32-bit world. If you find you need this, please consider using |
| 82 | * libcap to untrap yourself... |
| 83 | */ |
| 84 | #define _LINUX_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_1 |
| 85 | #define _LINUX_CAPABILITY_U32S _LINUX_CAPABILITY_U32S_1 |
| 86 | |
| 87 | #else |
| 88 | |
| 89 | #define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3 |
| 90 | #define _KERNEL_CAPABILITY_U32S _LINUX_CAPABILITY_U32S_3 |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 91 | |
Jaswinder Singh Rajput | 9fa91d9 | 2009-01-30 20:39:30 +0530 | [diff] [blame] | 92 | extern int file_caps_enabled; |
Jaswinder Singh Rajput | 9fa91d9 | 2009-01-30 20:39:30 +0530 | [diff] [blame] | 93 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 94 | typedef struct kernel_cap_struct { |
Andrew G. Morgan | ca05a99 | 2008-05-27 22:05:17 -0700 | [diff] [blame] | 95 | __u32 cap[_KERNEL_CAPABILITY_U32S]; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 96 | } kernel_cap_t; |
| 97 | |
Eric Paris | c0b0044 | 2008-11-11 21:48:10 +1100 | [diff] [blame] | 98 | /* exact same as vfs_cap_data but in cpu endian and always filled completely */ |
| 99 | struct cpu_vfs_cap_data { |
| 100 | __u32 magic_etc; |
| 101 | kernel_cap_t permitted; |
| 102 | kernel_cap_t inheritable; |
| 103 | }; |
| 104 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 105 | #define _USER_CAP_HEADER_SIZE (sizeof(struct __user_cap_header_struct)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 106 | #define _KERNEL_CAP_T_SIZE (sizeof(kernel_cap_t)) |
| 107 | |
| 108 | #endif |
| 109 | |
| 110 | |
| 111 | /** |
Serge E. Hallyn | b537677 | 2007-10-16 23:31:36 -0700 | [diff] [blame] | 112 | ** POSIX-draft defined capabilities. |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 113 | **/ |
| 114 | |
| 115 | /* In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this |
| 116 | overrides the restriction of changing file ownership and group |
| 117 | ownership. */ |
| 118 | |
| 119 | #define CAP_CHOWN 0 |
| 120 | |
| 121 | /* Override all DAC access, including ACL execute access if |
| 122 | [_POSIX_ACL] is defined. Excluding DAC access covered by |
| 123 | CAP_LINUX_IMMUTABLE. */ |
| 124 | |
| 125 | #define CAP_DAC_OVERRIDE 1 |
| 126 | |
| 127 | /* Overrides all DAC restrictions regarding read and search on files |
| 128 | and directories, including ACL restrictions if [_POSIX_ACL] is |
| 129 | defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. */ |
| 130 | |
| 131 | #define CAP_DAC_READ_SEARCH 2 |
Serge E. Hallyn | b537677 | 2007-10-16 23:31:36 -0700 | [diff] [blame] | 132 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 133 | /* Overrides all restrictions about allowed operations on files, where |
| 134 | file owner ID must be equal to the user ID, except where CAP_FSETID |
| 135 | is applicable. It doesn't override MAC and DAC restrictions. */ |
| 136 | |
| 137 | #define CAP_FOWNER 3 |
| 138 | |
| 139 | /* Overrides the following restrictions that the effective user ID |
| 140 | shall match the file owner ID when setting the S_ISUID and S_ISGID |
| 141 | bits on that file; that the effective group ID (or one of the |
| 142 | supplementary group IDs) shall match the file owner ID when setting |
| 143 | the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are |
| 144 | cleared on successful return from chown(2) (not implemented). */ |
| 145 | |
| 146 | #define CAP_FSETID 4 |
| 147 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 148 | /* Overrides the restriction that the real or effective user ID of a |
| 149 | process sending a signal must match the real or effective user ID |
| 150 | of the process receiving the signal. */ |
| 151 | |
| 152 | #define CAP_KILL 5 |
| 153 | |
| 154 | /* Allows setgid(2) manipulation */ |
| 155 | /* Allows setgroups(2) */ |
| 156 | /* Allows forged gids on socket credentials passing. */ |
| 157 | |
| 158 | #define CAP_SETGID 6 |
| 159 | |
| 160 | /* Allows set*uid(2) manipulation (including fsuid). */ |
| 161 | /* Allows forged pids on socket credentials passing. */ |
| 162 | |
| 163 | #define CAP_SETUID 7 |
| 164 | |
| 165 | |
| 166 | /** |
| 167 | ** Linux-specific capabilities |
| 168 | **/ |
| 169 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 170 | /* Without VFS support for capabilities: |
| 171 | * Transfer any capability in your permitted set to any pid, |
| 172 | * remove any capability in your permitted set from any pid |
| 173 | * With VFS support for capabilities (neither of above, but) |
Serge E. Hallyn | 3b7391d | 2008-02-04 22:29:45 -0800 | [diff] [blame] | 174 | * Add any capability from current's capability bounding set |
| 175 | * to the current process' inheritable set |
| 176 | * Allow taking bits out of capability bounding set |
Andrew G. Morgan | 3898b1b | 2008-04-28 02:13:40 -0700 | [diff] [blame] | 177 | * Allow modification of the securebits for a process |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 178 | */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 179 | |
| 180 | #define CAP_SETPCAP 8 |
| 181 | |
| 182 | /* Allow modification of S_IMMUTABLE and S_APPEND file attributes */ |
| 183 | |
| 184 | #define CAP_LINUX_IMMUTABLE 9 |
| 185 | |
| 186 | /* Allows binding to TCP/UDP sockets below 1024 */ |
| 187 | /* Allows binding to ATM VCIs below 32 */ |
| 188 | |
| 189 | #define CAP_NET_BIND_SERVICE 10 |
| 190 | |
| 191 | /* Allow broadcasting, listen to multicast */ |
| 192 | |
| 193 | #define CAP_NET_BROADCAST 11 |
| 194 | |
| 195 | /* Allow interface configuration */ |
| 196 | /* Allow administration of IP firewall, masquerading and accounting */ |
| 197 | /* Allow setting debug option on sockets */ |
| 198 | /* Allow modification of routing tables */ |
| 199 | /* Allow setting arbitrary process / process group ownership on |
| 200 | sockets */ |
| 201 | /* Allow binding to any address for transparent proxying */ |
| 202 | /* Allow setting TOS (type of service) */ |
| 203 | /* Allow setting promiscuous mode */ |
| 204 | /* Allow clearing driver statistics */ |
| 205 | /* Allow multicasting */ |
| 206 | /* Allow read/write of device-specific registers */ |
| 207 | /* Allow activation of ATM control sockets */ |
| 208 | |
| 209 | #define CAP_NET_ADMIN 12 |
| 210 | |
| 211 | /* Allow use of RAW sockets */ |
| 212 | /* Allow use of PACKET sockets */ |
| 213 | |
| 214 | #define CAP_NET_RAW 13 |
| 215 | |
| 216 | /* Allow locking of shared memory segments */ |
| 217 | /* Allow mlock and mlockall (which doesn't really have anything to do |
| 218 | with IPC) */ |
| 219 | |
| 220 | #define CAP_IPC_LOCK 14 |
| 221 | |
| 222 | /* Override IPC ownership checks */ |
| 223 | |
| 224 | #define CAP_IPC_OWNER 15 |
| 225 | |
| 226 | /* Insert and remove kernel modules - modify kernel without limit */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 227 | #define CAP_SYS_MODULE 16 |
| 228 | |
| 229 | /* Allow ioperm/iopl access */ |
| 230 | /* Allow sending USB messages to any device via /proc/bus/usb */ |
| 231 | |
| 232 | #define CAP_SYS_RAWIO 17 |
| 233 | |
| 234 | /* Allow use of chroot() */ |
| 235 | |
| 236 | #define CAP_SYS_CHROOT 18 |
| 237 | |
| 238 | /* Allow ptrace() of any process */ |
| 239 | |
| 240 | #define CAP_SYS_PTRACE 19 |
| 241 | |
| 242 | /* Allow configuration of process accounting */ |
| 243 | |
| 244 | #define CAP_SYS_PACCT 20 |
| 245 | |
| 246 | /* Allow configuration of the secure attention key */ |
| 247 | /* Allow administration of the random device */ |
| 248 | /* Allow examination and configuration of disk quotas */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 249 | /* Allow setting the domainname */ |
| 250 | /* Allow setting the hostname */ |
| 251 | /* Allow calling bdflush() */ |
| 252 | /* Allow mount() and umount(), setting up new smb connection */ |
| 253 | /* Allow some autofs root ioctls */ |
| 254 | /* Allow nfsservctl */ |
| 255 | /* Allow VM86_REQUEST_IRQ */ |
| 256 | /* Allow to read/write pci config on alpha */ |
| 257 | /* Allow irix_prctl on mips (setstacksize) */ |
| 258 | /* Allow flushing all cache on m68k (sys_cacheflush) */ |
| 259 | /* Allow removing semaphores */ |
| 260 | /* Used instead of CAP_CHOWN to "chown" IPC message queues, semaphores |
| 261 | and shared memory */ |
| 262 | /* Allow locking/unlocking of shared memory segment */ |
| 263 | /* Allow turning swap on/off */ |
| 264 | /* Allow forged pids on socket credentials passing */ |
| 265 | /* Allow setting readahead and flushing buffers on block devices */ |
| 266 | /* Allow setting geometry in floppy driver */ |
| 267 | /* Allow turning DMA on/off in xd driver */ |
| 268 | /* Allow administration of md devices (mostly the above, but some |
| 269 | extra ioctls) */ |
| 270 | /* Allow tuning the ide driver */ |
| 271 | /* Allow access to the nvram device */ |
| 272 | /* Allow administration of apm_bios, serial and bttv (TV) device */ |
| 273 | /* Allow manufacturer commands in isdn CAPI support driver */ |
| 274 | /* Allow reading non-standardized portions of pci configuration space */ |
| 275 | /* Allow DDI debug ioctl on sbpcd driver */ |
| 276 | /* Allow setting up serial ports */ |
| 277 | /* Allow sending raw qic-117 commands */ |
| 278 | /* Allow enabling/disabling tagged queuing on SCSI controllers and sending |
| 279 | arbitrary SCSI commands */ |
| 280 | /* Allow setting encryption key on loopback filesystem */ |
Martin Hicks | bce5f6ba | 2005-09-03 15:54:50 -0700 | [diff] [blame] | 281 | /* Allow setting zone reclaim policy */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 282 | |
| 283 | #define CAP_SYS_ADMIN 21 |
| 284 | |
| 285 | /* Allow use of reboot() */ |
| 286 | |
| 287 | #define CAP_SYS_BOOT 22 |
| 288 | |
| 289 | /* Allow raising priority and setting priority on other (different |
| 290 | UID) processes */ |
| 291 | /* Allow use of FIFO and round-robin (realtime) scheduling on own |
| 292 | processes and setting the scheduling algorithm used by another |
| 293 | process. */ |
| 294 | /* Allow setting cpu affinity on other processes */ |
| 295 | |
| 296 | #define CAP_SYS_NICE 23 |
| 297 | |
| 298 | /* Override resource limits. Set resource limits. */ |
| 299 | /* Override quota limits. */ |
| 300 | /* Override reserved space on ext2 filesystem */ |
| 301 | /* Modify data journaling mode on ext3 filesystem (uses journaling |
| 302 | resources) */ |
Serge E. Hallyn | b537677 | 2007-10-16 23:31:36 -0700 | [diff] [blame] | 303 | /* NOTE: ext2 honors fsuid when checking for resource overrides, so |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 304 | you can override using fsuid too */ |
| 305 | /* Override size restrictions on IPC message queues */ |
| 306 | /* Allow more than 64hz interrupts from the real-time clock */ |
| 307 | /* Override max number of consoles on console allocation */ |
| 308 | /* Override max number of keymaps */ |
| 309 | |
| 310 | #define CAP_SYS_RESOURCE 24 |
| 311 | |
| 312 | /* Allow manipulation of system clock */ |
| 313 | /* Allow irix_stime on mips */ |
| 314 | /* Allow setting the real-time clock */ |
| 315 | |
| 316 | #define CAP_SYS_TIME 25 |
| 317 | |
| 318 | /* Allow configuration of tty devices */ |
| 319 | /* Allow vhangup() of tty */ |
| 320 | |
| 321 | #define CAP_SYS_TTY_CONFIG 26 |
| 322 | |
| 323 | /* Allow the privileged aspects of mknod() */ |
| 324 | |
| 325 | #define CAP_MKNOD 27 |
| 326 | |
| 327 | /* Allow taking of leases on files */ |
| 328 | |
| 329 | #define CAP_LEASE 28 |
| 330 | |
| 331 | #define CAP_AUDIT_WRITE 29 |
| 332 | |
| 333 | #define CAP_AUDIT_CONTROL 30 |
| 334 | |
Serge E. Hallyn | b537677 | 2007-10-16 23:31:36 -0700 | [diff] [blame] | 335 | #define CAP_SETFCAP 31 |
| 336 | |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 337 | /* Override MAC access. |
| 338 | The base kernel enforces no MAC policy. |
| 339 | An LSM may enforce a MAC policy, and if it does and it chooses |
| 340 | to implement capability based overrides of that policy, this is |
| 341 | the capability it should use to do so. */ |
| 342 | |
| 343 | #define CAP_MAC_OVERRIDE 32 |
| 344 | |
| 345 | /* Allow MAC configuration or state changes. |
| 346 | The base kernel requires no MAC configuration. |
| 347 | An LSM may enforce a MAC policy, and if it does and it chooses |
| 348 | to implement capability based checks on modifications to that |
| 349 | policy or the data required to maintain it, this is the |
| 350 | capability it should use to do so. */ |
| 351 | |
| 352 | #define CAP_MAC_ADMIN 33 |
| 353 | |
Serge E. Hallyn | ce6ada3 | 2010-11-25 17:11:32 +0000 | [diff] [blame^] | 354 | /* Allow configuring the kernel's syslog (printk behaviour) */ |
| 355 | |
| 356 | #define CAP_SYSLOG 34 |
| 357 | |
| 358 | #define CAP_LAST_CAP CAP_SYSLOG |
Serge E. Hallyn | 3b7391d | 2008-02-04 22:29:45 -0800 | [diff] [blame] | 359 | |
| 360 | #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP) |
| 361 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 362 | /* |
| 363 | * Bit location of each capability (used by user-space library and kernel) |
| 364 | */ |
| 365 | |
| 366 | #define CAP_TO_INDEX(x) ((x) >> 5) /* 1 << 5 == bits in __u32 */ |
| 367 | #define CAP_TO_MASK(x) (1 << ((x) & 31)) /* mask for indexed __u32 */ |
| 368 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 369 | #ifdef __KERNEL__ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 370 | |
| 371 | /* |
| 372 | * Internal kernel functions only |
| 373 | */ |
Serge E. Hallyn | b537677 | 2007-10-16 23:31:36 -0700 | [diff] [blame] | 374 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 375 | #define CAP_FOR_EACH_U32(__capi) \ |
Andrew G. Morgan | ca05a99 | 2008-05-27 22:05:17 -0700 | [diff] [blame] | 376 | for (__capi = 0; __capi < _KERNEL_CAPABILITY_U32S; ++__capi) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 377 | |
Serge E. Hallyn | 0ad30b8 | 2009-04-13 09:56:14 -0500 | [diff] [blame] | 378 | /* |
| 379 | * CAP_FS_MASK and CAP_NFSD_MASKS: |
| 380 | * |
| 381 | * The fs mask is all the privileges that fsuid==0 historically meant. |
| 382 | * At one time in the past, that included CAP_MKNOD and CAP_LINUX_IMMUTABLE. |
| 383 | * |
| 384 | * It has never meant setting security.* and trusted.* xattrs. |
| 385 | * |
| 386 | * We could also define fsmask as follows: |
| 387 | * 1. CAP_FS_MASK is the privilege to bypass all fs-related DAC permissions |
| 388 | * 2. The security.* and trusted.* xattrs are fs-related MAC permissions |
| 389 | */ |
| 390 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 391 | # define CAP_FS_MASK_B0 (CAP_TO_MASK(CAP_CHOWN) \ |
Serge E. Hallyn | 0ad30b8 | 2009-04-13 09:56:14 -0500 | [diff] [blame] | 392 | | CAP_TO_MASK(CAP_MKNOD) \ |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 393 | | CAP_TO_MASK(CAP_DAC_OVERRIDE) \ |
| 394 | | CAP_TO_MASK(CAP_DAC_READ_SEARCH) \ |
| 395 | | CAP_TO_MASK(CAP_FOWNER) \ |
| 396 | | CAP_TO_MASK(CAP_FSETID)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 397 | |
Casey Schaufler | e114e47 | 2008-02-04 22:29:50 -0800 | [diff] [blame] | 398 | # define CAP_FS_MASK_B1 (CAP_TO_MASK(CAP_MAC_OVERRIDE)) |
| 399 | |
Andrew G. Morgan | ca05a99 | 2008-05-27 22:05:17 -0700 | [diff] [blame] | 400 | #if _KERNEL_CAPABILITY_U32S != 2 |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 401 | # error Fix up hand-coded capability macro initializers |
| 402 | #else /* HAND-CODED capability initializers */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 403 | |
David Howells | 25f2ea9 | 2008-04-29 20:54:28 +0100 | [diff] [blame] | 404 | # define CAP_EMPTY_SET ((kernel_cap_t){{ 0, 0 }}) |
| 405 | # define CAP_FULL_SET ((kernel_cap_t){{ ~0, ~0 }}) |
| 406 | # define CAP_INIT_EFF_SET ((kernel_cap_t){{ ~CAP_TO_MASK(CAP_SETPCAP), ~0 }}) |
Serge E. Hallyn | 0ad30b8 | 2009-04-13 09:56:14 -0500 | [diff] [blame] | 407 | # define CAP_FS_SET ((kernel_cap_t){{ CAP_FS_MASK_B0 \ |
| 408 | | CAP_TO_MASK(CAP_LINUX_IMMUTABLE), \ |
| 409 | CAP_FS_MASK_B1 } }) |
J. Bruce Fields | 76a67ec | 2009-03-16 18:34:20 -0400 | [diff] [blame] | 410 | # define CAP_NFSD_SET ((kernel_cap_t){{ CAP_FS_MASK_B0 \ |
Serge E. Hallyn | 0ad30b8 | 2009-04-13 09:56:14 -0500 | [diff] [blame] | 411 | | CAP_TO_MASK(CAP_SYS_RESOURCE), \ |
| 412 | CAP_FS_MASK_B1 } }) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 413 | |
Andrew G. Morgan | ca05a99 | 2008-05-27 22:05:17 -0700 | [diff] [blame] | 414 | #endif /* _KERNEL_CAPABILITY_U32S != 2 */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 415 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 416 | #define CAP_INIT_INH_SET CAP_EMPTY_SET |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 417 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 418 | # define cap_clear(c) do { (c) = __cap_empty_set; } while (0) |
| 419 | # define cap_set_full(c) do { (c) = __cap_full_set; } while (0) |
| 420 | # define cap_set_init_eff(c) do { (c) = __cap_init_eff_set; } while (0) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 421 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 422 | #define cap_raise(c, flag) ((c).cap[CAP_TO_INDEX(flag)] |= CAP_TO_MASK(flag)) |
| 423 | #define cap_lower(c, flag) ((c).cap[CAP_TO_INDEX(flag)] &= ~CAP_TO_MASK(flag)) |
| 424 | #define cap_raised(c, flag) ((c).cap[CAP_TO_INDEX(flag)] & CAP_TO_MASK(flag)) |
| 425 | |
| 426 | #define CAP_BOP_ALL(c, a, b, OP) \ |
| 427 | do { \ |
| 428 | unsigned __capi; \ |
| 429 | CAP_FOR_EACH_U32(__capi) { \ |
| 430 | c.cap[__capi] = a.cap[__capi] OP b.cap[__capi]; \ |
| 431 | } \ |
| 432 | } while (0) |
| 433 | |
| 434 | #define CAP_UOP_ALL(c, a, OP) \ |
| 435 | do { \ |
| 436 | unsigned __capi; \ |
| 437 | CAP_FOR_EACH_U32(__capi) { \ |
| 438 | c.cap[__capi] = OP a.cap[__capi]; \ |
| 439 | } \ |
| 440 | } while (0) |
| 441 | |
| 442 | static inline kernel_cap_t cap_combine(const kernel_cap_t a, |
| 443 | const kernel_cap_t b) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 444 | { |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 445 | kernel_cap_t dest; |
| 446 | CAP_BOP_ALL(dest, a, b, |); |
| 447 | return dest; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 448 | } |
| 449 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 450 | static inline kernel_cap_t cap_intersect(const kernel_cap_t a, |
| 451 | const kernel_cap_t b) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 452 | { |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 453 | kernel_cap_t dest; |
| 454 | CAP_BOP_ALL(dest, a, b, &); |
| 455 | return dest; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 456 | } |
| 457 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 458 | static inline kernel_cap_t cap_drop(const kernel_cap_t a, |
| 459 | const kernel_cap_t drop) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 460 | { |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 461 | kernel_cap_t dest; |
| 462 | CAP_BOP_ALL(dest, a, drop, &~); |
| 463 | return dest; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 464 | } |
| 465 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 466 | static inline kernel_cap_t cap_invert(const kernel_cap_t c) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 467 | { |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 468 | kernel_cap_t dest; |
| 469 | CAP_UOP_ALL(dest, c, ~); |
| 470 | return dest; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 471 | } |
| 472 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 473 | static inline int cap_isclear(const kernel_cap_t a) |
| 474 | { |
| 475 | unsigned __capi; |
| 476 | CAP_FOR_EACH_U32(__capi) { |
| 477 | if (a.cap[__capi] != 0) |
| 478 | return 0; |
| 479 | } |
| 480 | return 1; |
| 481 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 482 | |
Eric Paris | 9d36be7 | 2008-11-11 21:48:07 +1100 | [diff] [blame] | 483 | /* |
| 484 | * Check if "a" is a subset of "set". |
| 485 | * return 1 if ALL of the capabilities in "a" are also in "set" |
| 486 | * cap_issubset(0101, 1111) will return 1 |
| 487 | * return 0 if ANY of the capabilities in "a" are not in "set" |
| 488 | * cap_issubset(1111, 0101) will return 0 |
| 489 | */ |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 490 | static inline int cap_issubset(const kernel_cap_t a, const kernel_cap_t set) |
| 491 | { |
| 492 | kernel_cap_t dest; |
| 493 | dest = cap_drop(a, set); |
| 494 | return cap_isclear(dest); |
| 495 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 496 | |
Andrew Morgan | e338d26 | 2008-02-04 22:29:42 -0800 | [diff] [blame] | 497 | /* Used to decide between falling back on the old suser() or fsuser(). */ |
| 498 | |
| 499 | static inline int cap_is_fs_cap(int cap) |
| 500 | { |
| 501 | const kernel_cap_t __cap_fs_set = CAP_FS_SET; |
| 502 | return !!(CAP_TO_MASK(cap) & __cap_fs_set.cap[CAP_TO_INDEX(cap)]); |
| 503 | } |
| 504 | |
| 505 | static inline kernel_cap_t cap_drop_fs_set(const kernel_cap_t a) |
| 506 | { |
| 507 | const kernel_cap_t __cap_fs_set = CAP_FS_SET; |
| 508 | return cap_drop(a, __cap_fs_set); |
| 509 | } |
| 510 | |
| 511 | static inline kernel_cap_t cap_raise_fs_set(const kernel_cap_t a, |
| 512 | const kernel_cap_t permitted) |
| 513 | { |
| 514 | const kernel_cap_t __cap_fs_set = CAP_FS_SET; |
| 515 | return cap_combine(a, |
| 516 | cap_intersect(permitted, __cap_fs_set)); |
| 517 | } |
| 518 | |
| 519 | static inline kernel_cap_t cap_drop_nfsd_set(const kernel_cap_t a) |
| 520 | { |
| 521 | const kernel_cap_t __cap_fs_set = CAP_NFSD_SET; |
| 522 | return cap_drop(a, __cap_fs_set); |
| 523 | } |
| 524 | |
| 525 | static inline kernel_cap_t cap_raise_nfsd_set(const kernel_cap_t a, |
| 526 | const kernel_cap_t permitted) |
| 527 | { |
| 528 | const kernel_cap_t __cap_nfsd_set = CAP_NFSD_SET; |
| 529 | return cap_combine(a, |
| 530 | cap_intersect(permitted, __cap_nfsd_set)); |
| 531 | } |
| 532 | |
| 533 | extern const kernel_cap_t __cap_empty_set; |
| 534 | extern const kernel_cap_t __cap_full_set; |
| 535 | extern const kernel_cap_t __cap_init_eff_set; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 536 | |
David Howells | 5cd9c58 | 2008-08-14 11:37:28 +0100 | [diff] [blame] | 537 | /** |
| 538 | * has_capability - Determine if a task has a superior capability available |
| 539 | * @t: The task in question |
| 540 | * @cap: The capability to be tested for |
| 541 | * |
| 542 | * Return true if the specified task has the given superior capability |
| 543 | * currently in effect, false if not. |
| 544 | * |
| 545 | * Note that this does not set PF_SUPERPRIV on the task. |
| 546 | */ |
David Howells | 3699c53 | 2009-01-06 22:27:01 +0000 | [diff] [blame] | 547 | #define has_capability(t, cap) (security_real_capable((t), (cap)) == 0) |
| 548 | |
| 549 | /** |
| 550 | * has_capability_noaudit - Determine if a task has a superior capability available (unaudited) |
| 551 | * @t: The task in question |
| 552 | * @cap: The capability to be tested for |
| 553 | * |
| 554 | * Return true if the specified task has the given superior capability |
| 555 | * currently in effect, false if not, but don't write an audit message for the |
| 556 | * check. |
| 557 | * |
| 558 | * Note that this does not set PF_SUPERPRIV on the task. |
| 559 | */ |
| 560 | #define has_capability_noaudit(t, cap) \ |
| 561 | (security_real_capable_noaudit((t), (cap)) == 0) |
David Howells | 5cd9c58 | 2008-08-14 11:37:28 +0100 | [diff] [blame] | 562 | |
| 563 | extern int capable(int cap); |
Randy.Dunlap | c59ede7 | 2006-01-11 12:17:46 -0800 | [diff] [blame] | 564 | |
Eric Paris | 851f7ff | 2008-11-11 21:48:14 +1100 | [diff] [blame] | 565 | /* audit system wants to get cap info from files as well */ |
| 566 | struct dentry; |
| 567 | extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps); |
| 568 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 569 | #endif /* __KERNEL__ */ |
| 570 | |
| 571 | #endif /* !_LINUX_CAPABILITY_H */ |