Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 1 | // Copyright (C) 2016 The Android Open Source Project |
| 2 | // |
| 3 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | // you may not use this file except in compliance with the License. |
| 5 | // You may obtain a copy of the License at |
| 6 | // |
| 7 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | // |
| 9 | // Unless required by applicable law or agreed to in writing, software |
| 10 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | // See the License for the specific language governing permissions and |
| 13 | // limitations under the License. |
| 14 | |
| 15 | #include "capabilities.h" |
| 16 | |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 17 | #include <sys/prctl.h> |
| 18 | |
| 19 | #include <map> |
| 20 | #include <memory> |
| 21 | |
| 22 | #include <android-base/logging.h> |
| 23 | #include <android-base/macros.h> |
| 24 | |
| 25 | #define CAP_MAP_ENTRY(cap) { #cap, CAP_##cap } |
| 26 | |
Tom Cherry | 81f5d3e | 2017-06-22 12:53:17 -0700 | [diff] [blame] | 27 | namespace android { |
| 28 | namespace init { |
| 29 | |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 30 | static const std::map<std::string, int> cap_map = { |
Christopher Ferris | ab60ca5 | 2020-08-03 12:39:14 -0700 | [diff] [blame] | 31 | CAP_MAP_ENTRY(CHOWN), |
| 32 | CAP_MAP_ENTRY(DAC_OVERRIDE), |
| 33 | CAP_MAP_ENTRY(DAC_READ_SEARCH), |
| 34 | CAP_MAP_ENTRY(FOWNER), |
| 35 | CAP_MAP_ENTRY(FSETID), |
| 36 | CAP_MAP_ENTRY(KILL), |
| 37 | CAP_MAP_ENTRY(SETGID), |
| 38 | CAP_MAP_ENTRY(SETUID), |
| 39 | CAP_MAP_ENTRY(SETPCAP), |
| 40 | CAP_MAP_ENTRY(LINUX_IMMUTABLE), |
| 41 | CAP_MAP_ENTRY(NET_BIND_SERVICE), |
| 42 | CAP_MAP_ENTRY(NET_BROADCAST), |
| 43 | CAP_MAP_ENTRY(NET_ADMIN), |
| 44 | CAP_MAP_ENTRY(NET_RAW), |
| 45 | CAP_MAP_ENTRY(IPC_LOCK), |
| 46 | CAP_MAP_ENTRY(IPC_OWNER), |
| 47 | CAP_MAP_ENTRY(SYS_MODULE), |
| 48 | CAP_MAP_ENTRY(SYS_RAWIO), |
| 49 | CAP_MAP_ENTRY(SYS_CHROOT), |
| 50 | CAP_MAP_ENTRY(SYS_PTRACE), |
| 51 | CAP_MAP_ENTRY(SYS_PACCT), |
| 52 | CAP_MAP_ENTRY(SYS_ADMIN), |
| 53 | CAP_MAP_ENTRY(SYS_BOOT), |
| 54 | CAP_MAP_ENTRY(SYS_NICE), |
| 55 | CAP_MAP_ENTRY(SYS_RESOURCE), |
| 56 | CAP_MAP_ENTRY(SYS_TIME), |
| 57 | CAP_MAP_ENTRY(SYS_TTY_CONFIG), |
| 58 | CAP_MAP_ENTRY(MKNOD), |
| 59 | CAP_MAP_ENTRY(LEASE), |
| 60 | CAP_MAP_ENTRY(AUDIT_WRITE), |
| 61 | CAP_MAP_ENTRY(AUDIT_CONTROL), |
| 62 | CAP_MAP_ENTRY(SETFCAP), |
| 63 | CAP_MAP_ENTRY(MAC_OVERRIDE), |
| 64 | CAP_MAP_ENTRY(MAC_ADMIN), |
| 65 | CAP_MAP_ENTRY(SYSLOG), |
| 66 | CAP_MAP_ENTRY(WAKE_ALARM), |
| 67 | CAP_MAP_ENTRY(BLOCK_SUSPEND), |
| 68 | CAP_MAP_ENTRY(AUDIT_READ), |
| 69 | #if defined(__BIONIC__) |
| 70 | CAP_MAP_ENTRY(PERFMON), |
| 71 | CAP_MAP_ENTRY(BPF), |
Christopher Ferris | 9bbb841 | 2020-10-19 11:55:12 -0700 | [diff] [blame^] | 72 | CAP_MAP_ENTRY(CHECKPOINT_RESTORE), |
Christopher Ferris | ab60ca5 | 2020-08-03 12:39:14 -0700 | [diff] [blame] | 73 | #endif |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 74 | }; |
| 75 | |
Christopher Ferris | ab60ca5 | 2020-08-03 12:39:14 -0700 | [diff] [blame] | 76 | #if defined(__BIONIC__) |
Christopher Ferris | 9bbb841 | 2020-10-19 11:55:12 -0700 | [diff] [blame^] | 77 | static_assert(CAP_LAST_CAP == CAP_CHECKPOINT_RESTORE, "CAP_LAST_CAP is not CAP_CHECKPOINT_RESTORE"); |
Christopher Ferris | ab60ca5 | 2020-08-03 12:39:14 -0700 | [diff] [blame] | 78 | #else |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 79 | static_assert(CAP_LAST_CAP == CAP_AUDIT_READ, "CAP_LAST_CAP is not CAP_AUDIT_READ"); |
Christopher Ferris | ab60ca5 | 2020-08-03 12:39:14 -0700 | [diff] [blame] | 80 | #endif |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 81 | |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 82 | static bool ComputeCapAmbientSupported() { |
Tom Cherry | de6bd50 | 2018-02-13 16:50:08 -0800 | [diff] [blame] | 83 | #if defined(__ANDROID__) |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 84 | return prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) >= 0; |
Tom Cherry | de6bd50 | 2018-02-13 16:50:08 -0800 | [diff] [blame] | 85 | #else |
| 86 | return true; |
| 87 | #endif |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 88 | } |
| 89 | |
| 90 | static unsigned int ComputeLastValidCap() { |
Tom Cherry | de6bd50 | 2018-02-13 16:50:08 -0800 | [diff] [blame] | 91 | #if defined(__ANDROID__) |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 92 | // Android does not support kernels < 3.8. 'CAP_WAKE_ALARM' has been present since 3.0, see |
| 93 | // http://lxr.free-electrons.com/source/include/linux/capability.h?v=3.0#L360. |
| 94 | unsigned int last_valid_cap = CAP_WAKE_ALARM; |
| 95 | for (; prctl(PR_CAPBSET_READ, last_valid_cap, 0, 0, 0) >= 0; ++last_valid_cap); |
| 96 | |
| 97 | // |last_valid_cap| will be the first failing value. |
| 98 | return last_valid_cap - 1; |
Tom Cherry | de6bd50 | 2018-02-13 16:50:08 -0800 | [diff] [blame] | 99 | #else |
| 100 | return CAP_LAST_CAP; |
| 101 | #endif |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 102 | } |
| 103 | |
| 104 | static bool DropBoundingSet(const CapSet& to_keep) { |
| 105 | unsigned int last_valid_cap = GetLastValidCap(); |
| 106 | // When dropping the bounding set, attempt to drop capabilities reported at |
| 107 | // run-time, not at compile-time. |
| 108 | // If the run-time kernel is older than the compile-time headers, this |
| 109 | // avoids dropping an invalid capability. If the run-time kernel is newer |
| 110 | // than the headers, this guarantees all capabilities (even those unknown at |
| 111 | // compile time) will be dropped. |
| 112 | for (size_t cap = 0; cap <= last_valid_cap; ++cap) { |
| 113 | if (cap < to_keep.size() && to_keep.test(cap)) { |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 114 | // No need to drop this capability. |
| 115 | continue; |
| 116 | } |
| 117 | if (cap_drop_bound(cap) == -1) { |
| 118 | PLOG(ERROR) << "cap_drop_bound(" << cap << ") failed"; |
| 119 | return false; |
| 120 | } |
| 121 | } |
| 122 | return true; |
| 123 | } |
| 124 | |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 125 | static bool SetProcCaps(const CapSet& to_keep, bool add_setpcap) { |
Luis Hector Chavez | 7bb3602 | 2017-06-29 09:47:51 -0700 | [diff] [blame] | 126 | ScopedCaps caps(cap_init()); |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 127 | |
Luis Hector Chavez | 7bb3602 | 2017-06-29 09:47:51 -0700 | [diff] [blame] | 128 | cap_clear(caps.get()); |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 129 | cap_value_t value[1]; |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 130 | for (size_t cap = 0; cap < to_keep.size(); ++cap) { |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 131 | if (to_keep.test(cap)) { |
| 132 | value[0] = cap; |
Luis Hector Chavez | 7bb3602 | 2017-06-29 09:47:51 -0700 | [diff] [blame] | 133 | if (cap_set_flag(caps.get(), CAP_INHERITABLE, arraysize(value), value, CAP_SET) != 0 || |
| 134 | cap_set_flag(caps.get(), CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0) { |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 135 | PLOG(ERROR) << "cap_set_flag(INHERITABLE|PERMITTED, " << cap << ") failed"; |
| 136 | return false; |
| 137 | } |
| 138 | } |
| 139 | } |
| 140 | |
| 141 | if (add_setpcap) { |
| 142 | value[0] = CAP_SETPCAP; |
Luis Hector Chavez | 7bb3602 | 2017-06-29 09:47:51 -0700 | [diff] [blame] | 143 | if (cap_set_flag(caps.get(), CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0 || |
| 144 | cap_set_flag(caps.get(), CAP_EFFECTIVE, arraysize(value), value, CAP_SET) != 0) { |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 145 | PLOG(ERROR) << "cap_set_flag(PERMITTED|EFFECTIVE, " << CAP_SETPCAP << ") failed"; |
| 146 | return false; |
| 147 | } |
| 148 | } |
| 149 | |
Luis Hector Chavez | 7bb3602 | 2017-06-29 09:47:51 -0700 | [diff] [blame] | 150 | if (cap_set_proc(caps.get()) != 0) { |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 151 | PLOG(ERROR) << "cap_set_proc(" << to_keep.to_ulong() << ") failed"; |
| 152 | return false; |
| 153 | } |
| 154 | return true; |
| 155 | } |
| 156 | |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 157 | static bool SetAmbientCaps(const CapSet& to_raise) { |
Tom Cherry | de6bd50 | 2018-02-13 16:50:08 -0800 | [diff] [blame] | 158 | #if defined(__ANDROID__) |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 159 | for (size_t cap = 0; cap < to_raise.size(); ++cap) { |
| 160 | if (to_raise.test(cap)) { |
| 161 | if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0) != 0) { |
| 162 | PLOG(ERROR) << "prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, " << cap << ") failed"; |
| 163 | return false; |
| 164 | } |
| 165 | } |
| 166 | } |
Tom Cherry | de6bd50 | 2018-02-13 16:50:08 -0800 | [diff] [blame] | 167 | #endif |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 168 | return true; |
| 169 | } |
| 170 | |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 171 | int LookupCap(const std::string& cap_name) { |
| 172 | auto e = cap_map.find(cap_name); |
| 173 | if (e != cap_map.end()) { |
| 174 | return e->second; |
| 175 | } else { |
| 176 | return -1; |
| 177 | } |
| 178 | } |
| 179 | |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 180 | bool CapAmbientSupported() { |
| 181 | static bool cap_ambient_supported = ComputeCapAmbientSupported(); |
| 182 | return cap_ambient_supported; |
| 183 | } |
| 184 | |
| 185 | unsigned int GetLastValidCap() { |
| 186 | static unsigned int last_valid_cap = ComputeLastValidCap(); |
| 187 | return last_valid_cap; |
| 188 | } |
| 189 | |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 190 | bool SetCapsForExec(const CapSet& to_keep) { |
| 191 | // Need to keep SETPCAP to drop bounding set below. |
| 192 | bool add_setpcap = true; |
| 193 | if (!SetProcCaps(to_keep, add_setpcap)) { |
| 194 | LOG(ERROR) << "failed to apply initial capset"; |
| 195 | return false; |
| 196 | } |
| 197 | |
| 198 | if (!DropBoundingSet(to_keep)) { |
| 199 | return false; |
| 200 | } |
| 201 | |
| 202 | // If SETPCAP wasn't specifically requested, drop it now. |
| 203 | add_setpcap = false; |
| 204 | if (!SetProcCaps(to_keep, add_setpcap)) { |
| 205 | LOG(ERROR) << "failed to apply final capset"; |
| 206 | return false; |
| 207 | } |
| 208 | |
| 209 | // Add the capabilities to the ambient set so that they are preserved across |
| 210 | // execve(2). |
| 211 | // See http://man7.org/linux/man-pages/man7/capabilities.7.html. |
| 212 | return SetAmbientCaps(to_keep); |
| 213 | } |
Tom Cherry | 81f5d3e | 2017-06-22 12:53:17 -0700 | [diff] [blame] | 214 | |
Luis Hector Chavez | 94fb5b0 | 2017-11-16 15:52:00 -0800 | [diff] [blame] | 215 | bool DropInheritableCaps() { |
| 216 | ScopedCaps caps(cap_get_proc()); |
| 217 | if (cap_clear_flag(caps.get(), CAP_INHERITABLE) == -1) { |
| 218 | PLOG(ERROR) << "cap_clear_flag(INHERITABLE) failed"; |
| 219 | return false; |
| 220 | } |
| 221 | if (cap_set_proc(caps.get()) != 0) { |
| 222 | PLOG(ERROR) << "cap_set_proc() failed"; |
| 223 | return false; |
| 224 | } |
| 225 | return true; |
| 226 | } |
| 227 | |
Tom Cherry | 81f5d3e | 2017-06-22 12:53:17 -0700 | [diff] [blame] | 228 | } // namespace init |
| 229 | } // namespace android |