security/commoncap.c

   1 /* Common capabilities, needed by capability.o and root_plug.o
   2  *
   3  *      This program is free software; you can redistribute it and/or modify
   4  *      it under the terms of the GNU General Public License as published by
   5  *      the Free Software Foundation; either version 2 of the License, or
   6  *      (at your option) any later version.
   7  *
   8  */
   9
  10 #include <linux/config.h>
  11 #include <linux/module.h>
  12 #include <linux/init.h>
  13 #include <linux/kernel.h>
  14 #include <linux/security.h>
  15 #include <linux/file.h>
  16 #include <linux/mm.h>
  17 #include <linux/mman.h>
  18 #include <linux/pagemap.h>
  19 #include <linux/swap.h>
  20 #include <linux/smp_lock.h>
  21 #include <linux/skbuff.h>
  22 #include <linux/netlink.h>
  23 #include <linux/ptrace.h>
  24 #include <linux/xattr.h>
  25 #include <linux/hugetlb.h>
  26
  27 int cap_capable (struct task_struct *tsk, int cap)
  28 {
  29         /* Derived from include/linux/sched.h:capable. */
  30         if (cap_raised (tsk->cap_effective, cap))
  31                 return 0;
  32         else
  33                 return -EPERM;
  34 }
  35
  36 int cap_ptrace (struct task_struct *parent, struct task_struct *child)
  37 {
  38         /* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */
  39         if (!cap_issubset (child->cap_permitted, current->cap_permitted) &&
  40             !capable (CAP_SYS_PTRACE))
  41                 return -EPERM;
  42         else
  43                 return 0;
  44 }
  45
  46 int cap_capget (struct task_struct *target, kernel_cap_t *effective,
  47                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
  48 {
  49         /* Derived from kernel/capability.c:sys_capget. */
  50         *effective = cap_t (target->cap_effective);
  51         *inheritable = cap_t (target->cap_inheritable);
  52         *permitted = cap_t (target->cap_permitted);
  53         return 0;
  54 }
  55
  56 int cap_capset_check (struct task_struct *target, kernel_cap_t *effective,
  57                       kernel_cap_t *inheritable, kernel_cap_t *permitted)
  58 {
  59         /* Derived from kernel/capability.c:sys_capset. */
  60         /* verify restrictions on target's new Inheritable set */
  61         if (!cap_issubset (*inheritable,
  62                            cap_combine (target->cap_inheritable,
  63                                         current->cap_permitted))) {
  64                 return -EPERM;
  65         }
  66
  67         /* verify restrictions on target's new Permitted set */
  68         if (!cap_issubset (*permitted,
  69                            cap_combine (target->cap_permitted,
  70                                         current->cap_permitted))) {
  71                 return -EPERM;
  72         }
  73
  74         /* verify the _new_Effective_ is a subset of the _new_Permitted_ */
  75         if (!cap_issubset (*effective, *permitted)) {
  76                 return -EPERM;
  77         }
  78
  79         return 0;
  80 }
  81
  82 void cap_capset_set (struct task_struct *target, kernel_cap_t *effective,
  83                      kernel_cap_t *inheritable, kernel_cap_t *permitted)
  84 {
  85         target->cap_effective = *effective;
  86         target->cap_inheritable = *inheritable;
  87         target->cap_permitted = *permitted;
  88 }
  89
  90 int cap_bprm_set_security (struct linux_binprm *bprm)
  91 {
  92         /* Copied from fs/exec.c:prepare_binprm. */
  93
  94         /* We don't have VFS support for capabilities yet */
  95         cap_clear (bprm->cap_inheritable);
  96         cap_clear (bprm->cap_permitted);
  97         cap_clear (bprm->cap_effective);
  98
  99         /*  To support inheritance of root-permissions and suid-root
 100          *  executables under compatibility mode, we raise all three
 101          *  capability sets for the file.
 102          *
 103          *  If only the real uid is 0, we only raise the inheritable
 104          *  and permitted sets of the executable file.
 105          */
 106
 107         if (!issecure (SECURE_NOROOT)) {
 108                 if (bprm->e_uid == 0 || current->uid == 0) {
 109                         cap_set_full (bprm->cap_inheritable);
 110                         cap_set_full (bprm->cap_permitted);
 111                 }
 112                 if (bprm->e_uid == 0)
 113                         cap_set_full (bprm->cap_effective);
 114         }
 115         return 0;
 116 }
 117
 118 void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
 119 {
 120         /* Derived from fs/exec.c:compute_creds. */
 121         kernel_cap_t new_permitted, working;
 122
 123         new_permitted = cap_intersect (bprm->cap_permitted, cap_bset);
 124         working = cap_intersect (bprm->cap_inheritable,
 125                                  current->cap_inheritable);
 126         new_permitted = cap_combine (new_permitted, working);
 127
 128         if (bprm->e_uid != current->uid || bprm->e_gid != current->gid ||
 129             !cap_issubset (new_permitted, current->cap_permitted)) {
 130                 current->mm->dumpable = 0;
 131
 132                 if (unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
 133                         if (!capable(CAP_SETUID)) {
 134                                 bprm->e_uid = current->uid;
 135                                 bprm->e_gid = current->gid;
 136                         }
 137                         if (!capable (CAP_SETPCAP)) {
 138                                 new_permitted = cap_intersect (new_permitted,
 139                                                         current->cap_permitted);
 140                         }
 141                 }
 142         }
 143
 144         current->suid = current->euid = current->fsuid = bprm->e_uid;
 145         current->sgid = current->egid = current->fsgid = bprm->e_gid;
 146
 147         /* For init, we want to retain the capabilities set
 148          * in the init_task struct. Thus we skip the usual
 149          * capability rules */
 150         if (current->pid != 1) {
 151                 current->cap_permitted = new_permitted;
 152                 current->cap_effective =
 153                     cap_intersect (new_permitted, bprm->cap_effective);
 154         }
 155
 156         /* AUD: Audit candidate if current->cap_effective is set */
 157
 158         current->keep_capabilities = 0;
 159 }
 160
 161 int cap_bprm_secureexec (struct linux_binprm *bprm)
 162 {
 163         /* If/when this module is enhanced to incorporate capability
 164            bits on files, the test below should be extended to also perform a
 165            test between the old and new capability sets.  For now,
 166            it simply preserves the legacy decision algorithm used by
 167            the old userland. */
 168         return (current->euid != current->uid ||
 169                 current->egid != current->gid);
 170 }
 171
 172 int cap_inode_setxattr(struct dentry *dentry, char *name, void *value,
 173                        size_t size, int flags)
 174 {
 175         if (!strncmp(name, XATTR_SECURITY_PREFIX,
 176                      sizeof(XATTR_SECURITY_PREFIX) - 1)  &&
 177             !capable(CAP_SYS_ADMIN))
 178                 return -EPERM;
 179         return 0;
 180 }
 181
 182 int cap_inode_removexattr(struct dentry *dentry, char *name)
 183 {
 184         if (!strncmp(name, XATTR_SECURITY_PREFIX,
 185                      sizeof(XATTR_SECURITY_PREFIX) - 1)  &&
 186             !capable(CAP_SYS_ADMIN))
 187                 return -EPERM;
 188         return 0;
 189 }
 190
 191 /* moved from kernel/sys.c. */
 192 /*
 193  * cap_emulate_setxuid() fixes the effective / permitted capabilities of
 194  * a process after a call to setuid, setreuid, or setresuid.
 195  *
 196  *  1) When set*uiding _from_ one of {r,e,s}uid == 0 _to_ all of
 197  *  {r,e,s}uid != 0, the permitted and effective capabilities are
 198  *  cleared.
 199  *
 200  *  2) When set*uiding _from_ euid == 0 _to_ euid != 0, the effective
 201  *  capabilities of the process are cleared.
 202  *
 203  *  3) When set*uiding _from_ euid != 0 _to_ euid == 0, the effective
 204  *  capabilities are set to the permitted capabilities.
 205  *
 206  *  fsuid is handled elsewhere. fsuid == 0 and {r,e,s}uid!= 0 should
 207  *  never happen.
 208  *
 209  *  -astor
 210  *
 211  * cevans - New behaviour, Oct '99
 212  * A process may, via prctl(), elect to keep its capabilities when it
 213  * calls setuid() and switches away from uid==0. Both permitted and
 214  * effective sets will be retained.
 215  * Without this change, it was impossible for a daemon to drop only some
 216  * of its privilege. The call to setuid(!=0) would drop all privileges!
 217  * Keeping uid 0 is not an option because uid 0 owns too many vital
 218  * files..
 219  * Thanks to Olaf Kirch and Peter Benie for spotting this.
 220  */
 221 static inline void cap_emulate_setxuid (int old_ruid, int old_euid,
 222                                         int old_suid)
 223 {
 224         if ((old_ruid == 0 || old_euid == 0 || old_suid == 0) &&
 225             (current->uid != 0 && current->euid != 0 && current->suid != 0) &&
 226             !current->keep_capabilities) {
 227                 cap_clear (current->cap_permitted);
 228                 cap_clear (current->cap_effective);
 229         }
 230         if (old_euid == 0 && current->euid != 0) {
 231                 cap_clear (current->cap_effective);
 232         }
 233         if (old_euid != 0 && current->euid == 0) {
 234                 current->cap_effective = current->cap_permitted;
 235         }
 236 }
 237
 238 int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid,
 239                           int flags)
 240 {
 241         switch (flags) {
 242         case LSM_SETID_RE:
 243         case LSM_SETID_ID:
 244         case LSM_SETID_RES:
 245                 /* Copied from kernel/sys.c:setreuid/setuid/setresuid. */
 246                 if (!issecure (SECURE_NO_SETUID_FIXUP)) {
 247                         cap_emulate_setxuid (old_ruid, old_euid, old_suid);
 248                 }
 249                 break;
 250         case LSM_SETID_FS:
 251                 {
 252                         uid_t old_fsuid = old_ruid;
 253
 254                         /* Copied from kernel/sys.c:setfsuid. */
 255
 256                         /*
 257                          * FIXME - is fsuser used for all CAP_FS_MASK capabilities?
 258                          *          if not, we might be a bit too harsh here.
 259                          */
 260
 261                         if (!issecure (SECURE_NO_SETUID_FIXUP)) {
 262                                 if (old_fsuid == 0 && current->fsuid != 0) {
 263                                         cap_t (current->cap_effective) &=
 264                                             ~CAP_FS_MASK;
 265                                 }
 266                                 if (old_fsuid != 0 && current->fsuid == 0) {
 267                                         cap_t (current->cap_effective) |=
 268                                             (cap_t (current->cap_permitted) &
 269                                              CAP_FS_MASK);
 270                                 }
 271                         }
 272                         break;
 273                 }
 274         default:
 275                 return -EINVAL;
 276         }
 277
 278         return 0;
 279 }
 280
 281 void cap_task_reparent_to_init (struct task_struct *p)
 282 {
 283         p->cap_effective = CAP_INIT_EFF_SET;
 284         p->cap_inheritable = CAP_INIT_INH_SET;
 285         p->cap_permitted = CAP_FULL_SET;
 286         p->keep_capabilities = 0;
 287         return;
 288 }
 289
 290 int cap_syslog (int type)
 291 {
 292         if ((type != 3 && type != 10) && !capable(CAP_SYS_ADMIN))
 293                 return -EPERM;
 294         return 0;
 295 }
 296
 297 /*
 298  * Check that a process has enough memory to allocate a new virtual
 299  * mapping. 0 means there is enough memory for the allocation to
 300  * succeed and -ENOMEM implies there is not.
 301  *
 302  * We currently support three overcommit policies, which are set via the
 303  * vm.overcommit_memory sysctl.  See Documentation/vm/overcommit-accounting
 304  *
 305  * Strict overcommit modes added 2002 Feb 26 by Alan Cox.
 306  * Additional code 2002 Jul 20 by Robert Love.
 307  */
 308 int cap_vm_enough_memory(long pages)
 309 {
 310         unsigned long free, allowed;
 311
 312         vm_acct_memory(pages);
 313
 314         /*
 315          * Sometimes we want to use more memory than we have
 316          */
 317         if (sysctl_overcommit_memory == OVERCOMMIT_ALWAYS)
 318                 return 0;
 319
 320         if (sysctl_overcommit_memory == OVERCOMMIT_GUESS) {
 321                 unsigned long n;
 322
 323                 free = get_page_cache_size();
 324                 free += nr_swap_pages;
 325
 326                 /*
 327                  * Any slabs which are created with the
 328                  * SLAB_RECLAIM_ACCOUNT flag claim to have contents
 329                  * which are reclaimable, under pressure.  The dentry
 330                  * cache and most inode caches should fall into this
 331                  */
 332                 free += atomic_read(&slab_reclaim_pages);
 333
 334                 /*
 335                  * Leave the last 3% for root
 336                  */
 337                 if (!capable(CAP_SYS_ADMIN))
 338                         free -= free / 32;
 339
 340                 if (free > pages)
 341                         return 0;
 342
 343                 /*
 344                  * nr_free_pages() is very expensive on large systems,
 345                  * only call if we're about to fail.
 346                  */
 347                 n = nr_free_pages();
 348                 if (!capable(CAP_SYS_ADMIN))
 349                         n -= n / 32;
 350                 free += n;
 351
 352                 if (free > pages)
 353                         return 0;
 354                 vm_unacct_memory(pages);
 355                 return -ENOMEM;
 356         }
 357
 358         allowed = (totalram_pages - hugetlb_total_pages())
 359                 * sysctl_overcommit_ratio / 100;
 360         /*
 361          * Leave the last 3% for root
 362          */
 363         if (!capable(CAP_SYS_ADMIN))
 364                 allowed -= allowed / 32;
 365         allowed += total_swap_pages;
 366
 367         if (atomic_read(&vm_committed_space) < allowed)
 368                 return 0;
 369
 370         vm_unacct_memory(pages);
 371
 372         return -ENOMEM;
 373 }
 374
 375 EXPORT_SYMBOL(cap_capable);
 376 EXPORT_SYMBOL(cap_ptrace);
 377 EXPORT_SYMBOL(cap_capget);
 378 EXPORT_SYMBOL(cap_capset_check);
 379 EXPORT_SYMBOL(cap_capset_set);
 380 EXPORT_SYMBOL(cap_bprm_set_security);
 381 EXPORT_SYMBOL(cap_bprm_apply_creds);
 382 EXPORT_SYMBOL(cap_bprm_secureexec);
 383 EXPORT_SYMBOL(cap_inode_setxattr);
 384 EXPORT_SYMBOL(cap_inode_removexattr);
 385 EXPORT_SYMBOL(cap_task_post_setuid);
 386 EXPORT_SYMBOL(cap_task_reparent_to_init);
 387 EXPORT_SYMBOL(cap_syslog);
 388 EXPORT_SYMBOL(cap_vm_enough_memory);
 389
 390 MODULE_DESCRIPTION("Standard Linux Common Capabilities Security Module");
 391 MODULE_LICENSE("GPL");