Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 1 | // Copyright (C) 2016 The Android Open Source Project |
| 2 | // |
| 3 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | // you may not use this file except in compliance with the License. |
| 5 | // You may obtain a copy of the License at |
| 6 | // |
| 7 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | // |
| 9 | // Unless required by applicable law or agreed to in writing, software |
| 10 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | // See the License for the specific language governing permissions and |
| 13 | // limitations under the License. |
| 14 | |
| 15 | #include "capabilities.h" |
| 16 | |
| 17 | #include <sys/capability.h> |
| 18 | #include <sys/prctl.h> |
| 19 | |
| 20 | #include <map> |
| 21 | #include <memory> |
| 22 | |
| 23 | #include <android-base/logging.h> |
| 24 | #include <android-base/macros.h> |
| 25 | |
| 26 | #define CAP_MAP_ENTRY(cap) { #cap, CAP_##cap } |
| 27 | |
| 28 | namespace { |
| 29 | const std::map<std::string, int> cap_map = { |
| 30 | CAP_MAP_ENTRY(CHOWN), |
| 31 | CAP_MAP_ENTRY(DAC_OVERRIDE), |
| 32 | CAP_MAP_ENTRY(DAC_READ_SEARCH), |
| 33 | CAP_MAP_ENTRY(FOWNER), |
| 34 | CAP_MAP_ENTRY(FSETID), |
| 35 | CAP_MAP_ENTRY(KILL), |
| 36 | CAP_MAP_ENTRY(SETGID), |
| 37 | CAP_MAP_ENTRY(SETUID), |
| 38 | CAP_MAP_ENTRY(SETPCAP), |
| 39 | CAP_MAP_ENTRY(LINUX_IMMUTABLE), |
| 40 | CAP_MAP_ENTRY(NET_BIND_SERVICE), |
| 41 | CAP_MAP_ENTRY(NET_BROADCAST), |
| 42 | CAP_MAP_ENTRY(NET_ADMIN), |
| 43 | CAP_MAP_ENTRY(NET_RAW), |
| 44 | CAP_MAP_ENTRY(IPC_LOCK), |
| 45 | CAP_MAP_ENTRY(IPC_OWNER), |
| 46 | CAP_MAP_ENTRY(SYS_MODULE), |
| 47 | CAP_MAP_ENTRY(SYS_RAWIO), |
| 48 | CAP_MAP_ENTRY(SYS_CHROOT), |
| 49 | CAP_MAP_ENTRY(SYS_PTRACE), |
| 50 | CAP_MAP_ENTRY(SYS_PACCT), |
| 51 | CAP_MAP_ENTRY(SYS_ADMIN), |
| 52 | CAP_MAP_ENTRY(SYS_BOOT), |
| 53 | CAP_MAP_ENTRY(SYS_NICE), |
| 54 | CAP_MAP_ENTRY(SYS_RESOURCE), |
| 55 | CAP_MAP_ENTRY(SYS_TIME), |
| 56 | CAP_MAP_ENTRY(SYS_TTY_CONFIG), |
| 57 | CAP_MAP_ENTRY(MKNOD), |
| 58 | CAP_MAP_ENTRY(LEASE), |
| 59 | CAP_MAP_ENTRY(AUDIT_WRITE), |
| 60 | CAP_MAP_ENTRY(AUDIT_CONTROL), |
| 61 | CAP_MAP_ENTRY(SETFCAP), |
| 62 | CAP_MAP_ENTRY(MAC_OVERRIDE), |
| 63 | CAP_MAP_ENTRY(MAC_ADMIN), |
| 64 | CAP_MAP_ENTRY(SYSLOG), |
| 65 | CAP_MAP_ENTRY(WAKE_ALARM), |
| 66 | CAP_MAP_ENTRY(BLOCK_SUSPEND), |
| 67 | CAP_MAP_ENTRY(AUDIT_READ), |
| 68 | }; |
| 69 | |
| 70 | static_assert(CAP_LAST_CAP == CAP_AUDIT_READ, "CAP_LAST_CAP is not CAP_AUDIT_READ"); |
| 71 | |
| 72 | bool DropBoundingSet(const CapSet& to_keep) { |
| 73 | for (size_t cap = 0; cap < to_keep.size(); ++cap) { |
| 74 | if (to_keep.test(cap)) { |
| 75 | // No need to drop this capability. |
| 76 | continue; |
| 77 | } |
| 78 | if (cap_drop_bound(cap) == -1) { |
| 79 | PLOG(ERROR) << "cap_drop_bound(" << cap << ") failed"; |
| 80 | return false; |
| 81 | } |
| 82 | } |
| 83 | return true; |
| 84 | } |
| 85 | |
| 86 | bool SetProcCaps(const CapSet& to_keep, bool add_setpcap) { |
| 87 | cap_t caps = cap_init(); |
| 88 | auto deleter = [](cap_t* p) { cap_free(*p); }; |
| 89 | std::unique_ptr<cap_t, decltype(deleter)> ptr_caps(&caps, deleter); |
| 90 | |
| 91 | cap_clear(caps); |
| 92 | cap_value_t value[1]; |
| 93 | for (size_t cap = 0; cap <= to_keep.size(); ++cap) { |
| 94 | if (to_keep.test(cap)) { |
| 95 | value[0] = cap; |
| 96 | if (cap_set_flag(caps, CAP_INHERITABLE, arraysize(value), value, CAP_SET) != 0 || |
| 97 | cap_set_flag(caps, CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0) { |
| 98 | PLOG(ERROR) << "cap_set_flag(INHERITABLE|PERMITTED, " << cap << ") failed"; |
| 99 | return false; |
| 100 | } |
| 101 | } |
| 102 | } |
| 103 | |
| 104 | if (add_setpcap) { |
| 105 | value[0] = CAP_SETPCAP; |
| 106 | if (cap_set_flag(caps, CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0 || |
| 107 | cap_set_flag(caps, CAP_EFFECTIVE, arraysize(value), value, CAP_SET) != 0) { |
| 108 | PLOG(ERROR) << "cap_set_flag(PERMITTED|EFFECTIVE, " << CAP_SETPCAP << ") failed"; |
| 109 | return false; |
| 110 | } |
| 111 | } |
| 112 | |
| 113 | if (cap_set_proc(caps) != 0) { |
| 114 | PLOG(ERROR) << "cap_set_proc(" << to_keep.to_ulong() << ") failed"; |
| 115 | return false; |
| 116 | } |
| 117 | return true; |
| 118 | } |
| 119 | |
| 120 | bool SetAmbientCaps(const CapSet& to_raise) { |
| 121 | for (size_t cap = 0; cap < to_raise.size(); ++cap) { |
| 122 | if (to_raise.test(cap)) { |
| 123 | if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0) != 0) { |
| 124 | PLOG(ERROR) << "prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, " << cap << ") failed"; |
| 125 | return false; |
| 126 | } |
| 127 | } |
| 128 | } |
| 129 | return true; |
| 130 | } |
| 131 | |
| 132 | } // namespace anonymous |
| 133 | |
| 134 | int LookupCap(const std::string& cap_name) { |
| 135 | auto e = cap_map.find(cap_name); |
| 136 | if (e != cap_map.end()) { |
| 137 | return e->second; |
| 138 | } else { |
| 139 | return -1; |
| 140 | } |
| 141 | } |
| 142 | |
| 143 | bool SetCapsForExec(const CapSet& to_keep) { |
| 144 | // Need to keep SETPCAP to drop bounding set below. |
| 145 | bool add_setpcap = true; |
| 146 | if (!SetProcCaps(to_keep, add_setpcap)) { |
| 147 | LOG(ERROR) << "failed to apply initial capset"; |
| 148 | return false; |
| 149 | } |
| 150 | |
| 151 | if (!DropBoundingSet(to_keep)) { |
| 152 | return false; |
| 153 | } |
| 154 | |
| 155 | // If SETPCAP wasn't specifically requested, drop it now. |
| 156 | add_setpcap = false; |
| 157 | if (!SetProcCaps(to_keep, add_setpcap)) { |
| 158 | LOG(ERROR) << "failed to apply final capset"; |
| 159 | return false; |
| 160 | } |
| 161 | |
| 162 | // Add the capabilities to the ambient set so that they are preserved across |
| 163 | // execve(2). |
| 164 | // See http://man7.org/linux/man-pages/man7/capabilities.7.html. |
| 165 | return SetAmbientCaps(to_keep); |
| 166 | } |