2 * linux/kernel/capability.c
4 * Copyright (C) 1997 Andrew Main <zefram@fysh.org>
6 * Integrated into 2.1.97+, Andrew G. Morgan <morgan@kernel.org>
7 * 30 May 2002: Cleanup, Robert M. Love <rml@tech9.net>
10 #include <linux/audit.h>
11 #include <linux/capability.h>
13 #include <linux/module.h>
14 #include <linux/security.h>
15 #include <linux/syscalls.h>
16 #include <linux/pid_namespace.h>
17 #include <asm/uaccess.h>
18 #include "cred-internals.h"
21 * Leveraged for setting/resetting capabilities
24 const kernel_cap_t __cap_empty_set
= CAP_EMPTY_SET
;
25 const kernel_cap_t __cap_full_set
= CAP_FULL_SET
;
26 const kernel_cap_t __cap_init_eff_set
= CAP_INIT_EFF_SET
;
28 EXPORT_SYMBOL(__cap_empty_set
);
29 EXPORT_SYMBOL(__cap_full_set
);
30 EXPORT_SYMBOL(__cap_init_eff_set
);
32 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
33 int file_caps_enabled
= 1;
35 static int __init
file_caps_disable(char *str
)
37 file_caps_enabled
= 0;
40 __setup("no_file_caps", file_caps_disable
);
44 * More recent versions of libcap are available from:
46 * http://www.kernel.org/pub/linux/libs/security/linux-privs/
49 static void warn_legacy_capability_use(void)
53 char name
[sizeof(current
->comm
)];
55 printk(KERN_INFO
"warning: `%s' uses 32-bit capabilities"
56 " (legacy support in use)\n",
57 get_task_comm(name
, current
));
63 * Version 2 capabilities worked fine, but the linux/capability.h file
64 * that accompanied their introduction encouraged their use without
65 * the necessary user-space source code changes. As such, we have
66 * created a version 3 with equivalent functionality to version 2, but
67 * with a header change to protect legacy source code from using
68 * version 2 when it wanted to use version 1. If your system has code
69 * that trips the following warning, it is using version 2 specific
70 * capabilities and may be doing so insecurely.
72 * The remedy is to either upgrade your version of libcap (to 2.10+,
73 * if the application is linked against it), or recompile your
74 * application with modern kernel headers and this warning will go
78 static void warn_deprecated_v2(void)
83 char name
[sizeof(current
->comm
)];
85 printk(KERN_INFO
"warning: `%s' uses deprecated v2"
86 " capabilities in a way that may be insecure.\n",
87 get_task_comm(name
, current
));
93 * Version check. Return the number of u32s in each capability flag
94 * array, or a negative value on error.
96 static int cap_validate_magic(cap_user_header_t header
, unsigned *tocopy
)
100 if (get_user(version
, &header
->version
))
104 case _LINUX_CAPABILITY_VERSION_1
:
105 warn_legacy_capability_use();
106 *tocopy
= _LINUX_CAPABILITY_U32S_1
;
108 case _LINUX_CAPABILITY_VERSION_2
:
109 warn_deprecated_v2();
111 * fall through - v3 is otherwise equivalent to v2.
113 case _LINUX_CAPABILITY_VERSION_3
:
114 *tocopy
= _LINUX_CAPABILITY_U32S_3
;
117 if (put_user((u32
)_KERNEL_CAPABILITY_VERSION
, &header
->version
))
126 * The only thing that can change the capabilities of the current
127 * process is the current process. As such, we can't be in this code
128 * at the same time as we are in the process of setting capabilities
129 * in this process. The net result is that we can limit our use of
130 * locks to when we are reading the caps of another process.
132 static inline int cap_get_target_pid(pid_t pid
, kernel_cap_t
*pEp
,
133 kernel_cap_t
*pIp
, kernel_cap_t
*pPp
)
137 if (pid
&& (pid
!= task_pid_vnr(current
))) {
138 struct task_struct
*target
;
140 read_lock(&tasklist_lock
);
142 target
= find_task_by_vpid(pid
);
146 ret
= security_capget(target
, pEp
, pIp
, pPp
);
148 read_unlock(&tasklist_lock
);
150 ret
= security_capget(current
, pEp
, pIp
, pPp
);
156 * sys_capget - get the capabilities of a given process.
157 * @header: pointer to struct that contains capability version and
159 * @dataptr: pointer to struct that contains the effective, permitted,
160 * and inheritable capabilities that are returned
162 * Returns 0 on success and < 0 on error.
164 SYSCALL_DEFINE2(capget
, cap_user_header_t
, header
, cap_user_data_t
, dataptr
)
169 kernel_cap_t pE
, pI
, pP
;
171 ret
= cap_validate_magic(header
, &tocopy
);
175 if (get_user(pid
, &header
->pid
))
181 ret
= cap_get_target_pid(pid
, &pE
, &pI
, &pP
);
183 struct __user_cap_data_struct kdata
[_KERNEL_CAPABILITY_U32S
];
186 for (i
= 0; i
< tocopy
; i
++) {
187 kdata
[i
].effective
= pE
.cap
[i
];
188 kdata
[i
].permitted
= pP
.cap
[i
];
189 kdata
[i
].inheritable
= pI
.cap
[i
];
193 * Note, in the case, tocopy < _KERNEL_CAPABILITY_U32S,
194 * we silently drop the upper capabilities here. This
195 * has the effect of making older libcap
196 * implementations implicitly drop upper capability
197 * bits when they perform a: capget/modify/capset
200 * This behavior is considered fail-safe
201 * behavior. Upgrading the application to a newer
202 * version of libcap will enable access to the newer
205 * An alternative would be to return an error here
206 * (-ERANGE), but that causes legacy applications to
207 * unexpectidly fail; the capget/modify/capset aborts
208 * before modification is attempted and the application
211 if (copy_to_user(dataptr
, kdata
, tocopy
212 * sizeof(struct __user_cap_data_struct
))) {
221 * sys_capset - set capabilities for a process or (*) a group of processes
222 * @header: pointer to struct that contains capability version and
224 * @data: pointer to struct that contains the effective, permitted,
225 * and inheritable capabilities
227 * Set capabilities for the current process only. The ability to any other
228 * process(es) has been deprecated and removed.
230 * The restrictions on setting capabilities are specified as:
232 * I: any raised capabilities must be a subset of the old permitted
233 * P: any raised capabilities must be a subset of the old permitted
234 * E: must be set to a subset of new permitted
236 * Returns 0 on success and < 0 on error.
238 SYSCALL_DEFINE2(capset
, cap_user_header_t
, header
, const cap_user_data_t
, data
)
240 struct __user_cap_data_struct kdata
[_KERNEL_CAPABILITY_U32S
];
241 unsigned i
, tocopy
, copybytes
;
242 kernel_cap_t inheritable
, permitted
, effective
;
247 ret
= cap_validate_magic(header
, &tocopy
);
251 if (get_user(pid
, &header
->pid
))
254 /* may only affect current now */
255 if (pid
!= 0 && pid
!= task_pid_vnr(current
))
258 copybytes
= tocopy
* sizeof(struct __user_cap_data_struct
);
259 if (copybytes
> sizeof(kdata
))
262 if (copy_from_user(&kdata
, data
, copybytes
))
265 for (i
= 0; i
< tocopy
; i
++) {
266 effective
.cap
[i
] = kdata
[i
].effective
;
267 permitted
.cap
[i
] = kdata
[i
].permitted
;
268 inheritable
.cap
[i
] = kdata
[i
].inheritable
;
270 while (i
< _KERNEL_CAPABILITY_U32S
) {
271 effective
.cap
[i
] = 0;
272 permitted
.cap
[i
] = 0;
273 inheritable
.cap
[i
] = 0;
277 new = prepare_creds();
281 ret
= security_capset(new, current_cred(),
282 &effective
, &inheritable
, &permitted
);
286 audit_log_capset(pid
, new, current_cred());
288 return commit_creds(new);
296 * capable - Determine if the current task has a superior capability in effect
297 * @cap: The capability to be tested for
299 * Return true if the current task has the given superior capability currently
300 * available for use, false if not.
302 * This sets PF_SUPERPRIV on the task if the capability is available on the
303 * assumption that it's about to be used.
307 if (unlikely(!cap_valid(cap
))) {
308 printk(KERN_CRIT
"capable() called with invalid cap=%u\n", cap
);
312 if (security_capable(cap
) == 0) {
313 current
->flags
|= PF_SUPERPRIV
;
318 EXPORT_SYMBOL(capable
);