commoncap.c 38.9 KB
Newer Older
James Morris's avatar
James Morris committed
1
/* Common capabilities, needed by capability.o.
Linus Torvalds's avatar
Linus Torvalds committed
2 3 4 5 6 7 8 9
 *
 *	This program is free software; you can redistribute it and/or modify
 *	it under the terms of the GNU General Public License as published by
 *	the Free Software Foundation; either version 2 of the License, or
 *	(at your option) any later version.
 *
 */

10
#include <linux/capability.h>
11
#include <linux/audit.h>
Linus Torvalds's avatar
Linus Torvalds committed
12 13 14
#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
15
#include <linux/lsm_hooks.h>
Linus Torvalds's avatar
Linus Torvalds committed
16 17 18 19 20 21 22 23 24 25
#include <linux/file.h>
#include <linux/mm.h>
#include <linux/mman.h>
#include <linux/pagemap.h>
#include <linux/swap.h>
#include <linux/skbuff.h>
#include <linux/netlink.h>
#include <linux/ptrace.h>
#include <linux/xattr.h>
#include <linux/hugetlb.h>
26
#include <linux/mount.h>
27
#include <linux/sched.h>
28 29
#include <linux/prctl.h>
#include <linux/securebits.h>
30
#include <linux/user_namespace.h>
Al Viro's avatar
Al Viro committed
31
#include <linux/binfmts.h>
32
#include <linux/personality.h>
33

34 35 36 37 38 39 40 41 42 43 44
/*
 * If a non-root user executes a setuid-root binary in
 * !secure(SECURE_NOROOT) mode, then we raise capabilities.
 * However if fE is also set, then the intent is for only
 * the file capabilities to be applied, and the setuid-root
 * bit is left on either to change the uid (plausible) or
 * to get full privilege on a kernel without file capabilities
 * support.  So in that case we do not raise capabilities.
 *
 * Warn if that happens, once per boot.
 */
45
static void warn_setuid_and_fcaps_mixed(const char *fname)
46 47 48 49 50 51 52 53 54 55
{
	static int warned;
	if (!warned) {
		printk(KERN_INFO "warning: `%s' has both setuid-root and"
			" effective capabilities. Therefore not raising all"
			" capabilities.\n", fname);
		warned = 1;
	}
}

David Howells's avatar
David Howells committed
56 57
/**
 * cap_capable - Determine whether a task has a particular effective capability
58
 * @cred: The credentials to use
59
 * @ns:  The user namespace in which we need the capability
David Howells's avatar
David Howells committed
60 61 62 63 64 65
 * @cap: The capability to check for
 * @audit: Whether to write an audit message or not
 *
 * Determine whether the nominated task has the specified capability amongst
 * its effective set, returning 0 if it does, -ve if it does not.
 *
66 67 68 69
 * NOTE WELL: cap_has_capability() cannot be used like the kernel's capable()
 * and has_capability() functions.  That is, it has the reverse semantics:
 * cap_has_capability() returns 0 when a task has a capability, but the
 * kernel's capable() and has_capability() returns 1 for this case.
70
 */
71 72
int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
		int cap, int audit)
Linus Torvalds's avatar
Linus Torvalds committed
73
{
74
	struct user_namespace *ns = targ_ns;
75

76 77 78 79 80
	/* See if cred has the capability in the target user namespace
	 * by examining the target user namespace and all of the target
	 * user namespace's parents.
	 */
	for (;;) {
81
		/* Do we have the necessary capabilities? */
82
		if (ns == cred->user_ns)
83 84
			return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;

85 86 87 88 89
		/*
		 * If we're already at a lower level than we're looking for,
		 * we're done searching.
		 */
		if (ns->level <= cred->user_ns->level)
90 91
			return -EPERM;

92 93 94 95 96 97 98
		/* 
		 * The owner of the user namespace in the parent of the
		 * user namespace has all caps.
		 */
		if ((ns->parent == cred->user_ns) && uid_eq(ns->owner, cred->euid))
			return 0;

99
		/*
100
		 * If you have a capability in a parent user ns, then you have
101 102
		 * it over all children user namespaces as well.
		 */
103
		ns = ns->parent;
104 105 106
	}

	/* We never get here */
Linus Torvalds's avatar
Linus Torvalds committed
107 108
}

David Howells's avatar
David Howells committed
109 110 111 112 113 114 115 116
/**
 * cap_settime - Determine whether the current process may set the system clock
 * @ts: The time to set
 * @tz: The timezone to set
 *
 * Determine whether the current process may set the system clock and timezone
 * information, returning 0 if permission granted, -ve if denied.
 */
117
int cap_settime(const struct timespec64 *ts, const struct timezone *tz)
Linus Torvalds's avatar
Linus Torvalds committed
118 119 120 121 122 123
{
	if (!capable(CAP_SYS_TIME))
		return -EPERM;
	return 0;
}

David Howells's avatar
David Howells committed
124
/**
125
 * cap_ptrace_access_check - Determine whether the current process may access
David Howells's avatar
David Howells committed
126 127 128 129
 *			   another
 * @child: The process to be accessed
 * @mode: The mode of attachment.
 *
130 131 132 133 134 135
 * If we are in the same or an ancestor user_ns and have all the target
 * task's capabilities, then ptrace access is allowed.
 * If we have the ptrace capability to the target user_ns, then ptrace
 * access is allowed.
 * Else denied.
 *
David Howells's avatar
David Howells committed
136 137 138
 * Determine whether a process may access another, returning 0 if permission
 * granted, -ve if denied.
 */
139
int cap_ptrace_access_check(struct task_struct *child, unsigned int mode)
Linus Torvalds's avatar
Linus Torvalds committed
140
{
141
	int ret = 0;
142
	const struct cred *cred, *child_cred;
143
	const kernel_cap_t *caller_caps;
144 145

	rcu_read_lock();
146 147
	cred = current_cred();
	child_cred = __task_cred(child);
148 149 150 151
	if (mode & PTRACE_MODE_FSCREDS)
		caller_caps = &cred->cap_effective;
	else
		caller_caps = &cred->cap_permitted;
152
	if (cred->user_ns == child_cred->user_ns &&
153
	    cap_issubset(child_cred->cap_permitted, *caller_caps))
154
		goto out;
155
	if (ns_capable(child_cred->user_ns, CAP_SYS_PTRACE))
156 157 158
		goto out;
	ret = -EPERM;
out:
159 160
	rcu_read_unlock();
	return ret;
161 162
}

David Howells's avatar
David Howells committed
163 164 165 166
/**
 * cap_ptrace_traceme - Determine whether another process may trace the current
 * @parent: The task proposed to be the tracer
 *
167 168 169 170 171 172
 * If parent is in the same or an ancestor user_ns and has all current's
 * capabilities, then ptrace access is allowed.
 * If parent has the ptrace capability to current's user_ns, then ptrace
 * access is allowed.
 * Else denied.
 *
David Howells's avatar
David Howells committed
173 174 175
 * Determine whether the nominated task is permitted to trace the current
 * process, returning 0 if permission is granted, -ve if denied.
 */
176 177
int cap_ptrace_traceme(struct task_struct *parent)
{
178
	int ret = 0;
179
	const struct cred *cred, *child_cred;
180 181

	rcu_read_lock();
182 183
	cred = __task_cred(parent);
	child_cred = current_cred();
184
	if (cred->user_ns == child_cred->user_ns &&
185 186
	    cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
		goto out;
187
	if (has_ns_capability(parent, child_cred->user_ns, CAP_SYS_PTRACE))
188 189 190
		goto out;
	ret = -EPERM;
out:
191 192
	rcu_read_unlock();
	return ret;
Linus Torvalds's avatar
Linus Torvalds committed
193 194
}

David Howells's avatar
David Howells committed
195 196 197 198 199 200 201 202 203 204 205 206
/**
 * cap_capget - Retrieve a task's capability sets
 * @target: The task from which to retrieve the capability sets
 * @effective: The place to record the effective set
 * @inheritable: The place to record the inheritable set
 * @permitted: The place to record the permitted set
 *
 * This function retrieves the capabilities of the nominated task and returns
 * them to the caller.
 */
int cap_capget(struct task_struct *target, kernel_cap_t *effective,
	       kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds's avatar
Linus Torvalds committed
207
{
208
	const struct cred *cred;
209

Linus Torvalds's avatar
Linus Torvalds committed
210
	/* Derived from kernel/capability.c:sys_capget. */
211 212
	rcu_read_lock();
	cred = __task_cred(target);
213 214 215
	*effective   = cred->cap_effective;
	*inheritable = cred->cap_inheritable;
	*permitted   = cred->cap_permitted;
216
	rcu_read_unlock();
Linus Torvalds's avatar
Linus Torvalds committed
217 218 219
	return 0;
}

David Howells's avatar
David Howells committed
220 221 222 223
/*
 * Determine whether the inheritable capabilities are limited to the old
 * permitted set.  Returns 1 if they are limited, 0 if they are not.
 */
224 225 226
static inline int cap_inh_is_capped(void)
{

David Howells's avatar
David Howells committed
227 228 229
	/* they are so limited unless the current task has the CAP_SETPCAP
	 * capability
	 */
230
	if (cap_capable(current_cred(), current_cred()->user_ns,
231
			CAP_SETPCAP, SECURITY_CAP_AUDIT) == 0)
David Howells's avatar
David Howells committed
232 233
		return 0;
	return 1;
234
}
235

David Howells's avatar
David Howells committed
236 237 238 239 240 241 242 243 244 245 246 247
/**
 * cap_capset - Validate and apply proposed changes to current's capabilities
 * @new: The proposed new credentials; alterations should be made here
 * @old: The current task's current credentials
 * @effective: A pointer to the proposed new effective capabilities set
 * @inheritable: A pointer to the proposed new inheritable capabilities set
 * @permitted: A pointer to the proposed new permitted capabilities set
 *
 * This function validates and applies a proposed mass change to the current
 * process's capability sets.  The changes are made to the proposed new
 * credentials, and assuming no error, will be committed by the caller of LSM.
 */
248 249 250 251 252
int cap_capset(struct cred *new,
	       const struct cred *old,
	       const kernel_cap_t *effective,
	       const kernel_cap_t *inheritable,
	       const kernel_cap_t *permitted)
Linus Torvalds's avatar
Linus Torvalds committed
253
{
254 255 256 257
	if (cap_inh_is_capped() &&
	    !cap_issubset(*inheritable,
			  cap_combine(old->cap_inheritable,
				      old->cap_permitted)))
258
		/* incapable of using this inheritable set */
Linus Torvalds's avatar
Linus Torvalds committed
259
		return -EPERM;
260

261
	if (!cap_issubset(*inheritable,
262 263
			  cap_combine(old->cap_inheritable,
				      old->cap_bset)))
264 265
		/* no new pI capabilities outside bounding set */
		return -EPERM;
Linus Torvalds's avatar
Linus Torvalds committed
266 267

	/* verify restrictions on target's new Permitted set */
268
	if (!cap_issubset(*permitted, old->cap_permitted))
Linus Torvalds's avatar
Linus Torvalds committed
269 270 271
		return -EPERM;

	/* verify the _new_Effective_ is a subset of the _new_Permitted_ */
272
	if (!cap_issubset(*effective, *permitted))
Linus Torvalds's avatar
Linus Torvalds committed
273 274
		return -EPERM;

275 276 277
	new->cap_effective   = *effective;
	new->cap_inheritable = *inheritable;
	new->cap_permitted   = *permitted;
278 279 280 281 282 283 284 285 286 287

	/*
	 * Mask off ambient bits that are no longer both permitted and
	 * inheritable.
	 */
	new->cap_ambient = cap_intersect(new->cap_ambient,
					 cap_intersect(*permitted,
						       *inheritable));
	if (WARN_ON(!cap_ambient_invariant_ok(new)))
		return -EINVAL;
Linus Torvalds's avatar
Linus Torvalds committed
288 289 290
	return 0;
}

David Howells's avatar
David Howells committed
291 292 293 294 295 296
/**
 * cap_inode_need_killpriv - Determine if inode change affects privileges
 * @dentry: The inode/dentry in being changed with change marked ATTR_KILL_PRIV
 *
 * Determine if an inode having a change applied that's marked ATTR_KILL_PRIV
 * affects the security markings on that inode, and if it is, should
297
 * inode_killpriv() be invoked or the change rejected.
David Howells's avatar
David Howells committed
298
 *
299 300
 * Returns 1 if security.capability has a value, meaning inode_killpriv()
 * is required, 0 otherwise, meaning inode_killpriv() is not required.
David Howells's avatar
David Howells committed
301
 */
302 303
int cap_inode_need_killpriv(struct dentry *dentry)
{
304
	struct inode *inode = d_backing_inode(dentry);
305 306
	int error;

307 308
	error = __vfs_getxattr(dentry, inode, XATTR_NAME_CAPS, NULL, 0);
	return error > 0;
309 310
}

David Howells's avatar
David Howells committed
311 312 313 314 315 316 317 318
/**
 * cap_inode_killpriv - Erase the security markings on an inode
 * @dentry: The inode/dentry to alter
 *
 * Erase the privilege-enhancing security markings on an inode.
 *
 * Returns 0 if successful, -ve on error.
 */
319 320
int cap_inode_killpriv(struct dentry *dentry)
{
321
	int error;
322

323 324 325 326
	error = __vfs_removexattr(dentry, XATTR_NAME_CAPS);
	if (error == -EOPNOTSUPP)
		error = 0;
	return error;
327 328
}

329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531
static bool rootid_owns_currentns(kuid_t kroot)
{
	struct user_namespace *ns;

	if (!uid_valid(kroot))
		return false;

	for (ns = current_user_ns(); ; ns = ns->parent) {
		if (from_kuid(ns, kroot) == 0)
			return true;
		if (ns == &init_user_ns)
			break;
	}

	return false;
}

static __u32 sansflags(__u32 m)
{
	return m & ~VFS_CAP_FLAGS_EFFECTIVE;
}

static bool is_v2header(size_t size, __le32 magic)
{
	__u32 m = le32_to_cpu(magic);
	if (size != XATTR_CAPS_SZ_2)
		return false;
	return sansflags(m) == VFS_CAP_REVISION_2;
}

static bool is_v3header(size_t size, __le32 magic)
{
	__u32 m = le32_to_cpu(magic);

	if (size != XATTR_CAPS_SZ_3)
		return false;
	return sansflags(m) == VFS_CAP_REVISION_3;
}

/*
 * getsecurity: We are called for security.* before any attempt to read the
 * xattr from the inode itself.
 *
 * This gives us a chance to read the on-disk value and convert it.  If we
 * return -EOPNOTSUPP, then vfs_getxattr() will call the i_op handler.
 *
 * Note we are not called by vfs_getxattr_alloc(), but that is only called
 * by the integrity subsystem, which really wants the unconverted values -
 * so that's good.
 */
int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
			  bool alloc)
{
	int size, ret;
	kuid_t kroot;
	uid_t root, mappedroot;
	char *tmpbuf = NULL;
	struct vfs_cap_data *cap;
	struct vfs_ns_cap_data *nscap;
	struct dentry *dentry;
	struct user_namespace *fs_ns;

	if (strcmp(name, "capability") != 0)
		return -EOPNOTSUPP;

	dentry = d_find_alias(inode);
	if (!dentry)
		return -EINVAL;

	size = sizeof(struct vfs_ns_cap_data);
	ret = (int) vfs_getxattr_alloc(dentry, XATTR_NAME_CAPS,
				 &tmpbuf, size, GFP_NOFS);
	dput(dentry);

	if (ret < 0)
		return ret;

	fs_ns = inode->i_sb->s_user_ns;
	cap = (struct vfs_cap_data *) tmpbuf;
	if (is_v2header((size_t) ret, cap->magic_etc)) {
		/* If this is sizeof(vfs_cap_data) then we're ok with the
		 * on-disk value, so return that.  */
		if (alloc)
			*buffer = tmpbuf;
		else
			kfree(tmpbuf);
		return ret;
	} else if (!is_v3header((size_t) ret, cap->magic_etc)) {
		kfree(tmpbuf);
		return -EINVAL;
	}

	nscap = (struct vfs_ns_cap_data *) tmpbuf;
	root = le32_to_cpu(nscap->rootid);
	kroot = make_kuid(fs_ns, root);

	/* If the root kuid maps to a valid uid in current ns, then return
	 * this as a nscap. */
	mappedroot = from_kuid(current_user_ns(), kroot);
	if (mappedroot != (uid_t)-1 && mappedroot != (uid_t)0) {
		if (alloc) {
			*buffer = tmpbuf;
			nscap->rootid = cpu_to_le32(mappedroot);
		} else
			kfree(tmpbuf);
		return size;
	}

	if (!rootid_owns_currentns(kroot)) {
		kfree(tmpbuf);
		return -EOPNOTSUPP;
	}

	/* This comes from a parent namespace.  Return as a v2 capability */
	size = sizeof(struct vfs_cap_data);
	if (alloc) {
		*buffer = kmalloc(size, GFP_ATOMIC);
		if (*buffer) {
			struct vfs_cap_data *cap = *buffer;
			__le32 nsmagic, magic;
			magic = VFS_CAP_REVISION_2;
			nsmagic = le32_to_cpu(nscap->magic_etc);
			if (nsmagic & VFS_CAP_FLAGS_EFFECTIVE)
				magic |= VFS_CAP_FLAGS_EFFECTIVE;
			memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
			cap->magic_etc = cpu_to_le32(magic);
		}
	}
	kfree(tmpbuf);
	return size;
}

static kuid_t rootid_from_xattr(const void *value, size_t size,
				struct user_namespace *task_ns)
{
	const struct vfs_ns_cap_data *nscap = value;
	uid_t rootid = 0;

	if (size == XATTR_CAPS_SZ_3)
		rootid = le32_to_cpu(nscap->rootid);

	return make_kuid(task_ns, rootid);
}

static bool validheader(size_t size, __le32 magic)
{
	return is_v2header(size, magic) || is_v3header(size, magic);
}

/*
 * User requested a write of security.capability.  If needed, update the
 * xattr to change from v2 to v3, or to fixup the v3 rootid.
 *
 * If all is ok, we return the new size, on error return < 0.
 */
int cap_convert_nscap(struct dentry *dentry, void **ivalue, size_t size)
{
	struct vfs_ns_cap_data *nscap;
	uid_t nsrootid;
	const struct vfs_cap_data *cap = *ivalue;
	__u32 magic, nsmagic;
	struct inode *inode = d_backing_inode(dentry);
	struct user_namespace *task_ns = current_user_ns(),
		*fs_ns = inode->i_sb->s_user_ns;
	kuid_t rootid;
	size_t newsize;

	if (!*ivalue)
		return -EINVAL;
	if (!validheader(size, cap->magic_etc))
		return -EINVAL;
	if (!capable_wrt_inode_uidgid(inode, CAP_SETFCAP))
		return -EPERM;
	if (size == XATTR_CAPS_SZ_2)
		if (ns_capable(inode->i_sb->s_user_ns, CAP_SETFCAP))
			/* user is privileged, just write the v2 */
			return size;

	rootid = rootid_from_xattr(*ivalue, size, task_ns);
	if (!uid_valid(rootid))
		return -EINVAL;

	nsrootid = from_kuid(fs_ns, rootid);
	if (nsrootid == -1)
		return -EINVAL;

	newsize = sizeof(struct vfs_ns_cap_data);
	nscap = kmalloc(newsize, GFP_ATOMIC);
	if (!nscap)
		return -ENOMEM;
	nscap->rootid = cpu_to_le32(nsrootid);
	nsmagic = VFS_CAP_REVISION_3;
	magic = le32_to_cpu(cap->magic_etc);
	if (magic & VFS_CAP_FLAGS_EFFECTIVE)
		nsmagic |= VFS_CAP_FLAGS_EFFECTIVE;
	nscap->magic_etc = cpu_to_le32(nsmagic);
	memcpy(&nscap->data, &cap->data, sizeof(__le32) * 2 * VFS_CAP_U32);

	kvfree(*ivalue);
	*ivalue = nscap;
	return newsize;
}

David Howells's avatar
David Howells committed
532 533 534 535
/*
 * Calculate the new process capability sets from the capability sets attached
 * to a file.
 */
536
static inline int bprm_caps_from_vfs_caps(struct cpu_vfs_cap_data *caps,
537
					  struct linux_binprm *bprm,
538
					  bool *effective,
539
					  bool *has_fcap)
540
{
541
	struct cred *new = bprm->cred;
542 543 544 545
	unsigned i;
	int ret = 0;

	if (caps->magic_etc & VFS_CAP_FLAGS_EFFECTIVE)
546
		*effective = true;
547

548
	if (caps->magic_etc & VFS_CAP_REVISION_MASK)
549
		*has_fcap = true;
550

551 552 553 554 555 556
	CAP_FOR_EACH_U32(i) {
		__u32 permitted = caps->permitted.cap[i];
		__u32 inheritable = caps->inheritable.cap[i];

		/*
		 * pP' = (X & fP) | (pI & fI)
557
		 * The addition of pA' is handled later.
558
		 */
559 560 561
		new->cap_permitted.cap[i] =
			(new->cap_bset.cap[i] & permitted) |
			(new->cap_inheritable.cap[i] & inheritable);
562

563 564
		if (permitted & ~new->cap_permitted.cap[i])
			/* insufficient to execute correctly */
565 566 567 568 569 570 571 572
			ret = -EPERM;
	}

	/*
	 * For legacy apps, with no internal support for recognizing they
	 * do not have enough capabilities, we return an error if they are
	 * missing some "forced" (aka file-permitted) capabilities.
	 */
573
	return *effective ? ret : 0;
574 575
}

David Howells's avatar
David Howells committed
576 577 578
/*
 * Extract the on-exec-apply capability sets for an executable file.
 */
579 580
int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps)
{
581
	struct inode *inode = d_backing_inode(dentry);
582
	__u32 magic_etc;
583
	unsigned tocopy, i;
584
	int size;
585 586 587
	struct vfs_ns_cap_data data, *nscaps = &data;
	struct vfs_cap_data *caps = (struct vfs_cap_data *) &data;
	kuid_t rootkuid;
588
	struct user_namespace *fs_ns;
589 590 591

	memset(cpu_caps, 0, sizeof(struct cpu_vfs_cap_data));

592
	if (!inode)
593 594
		return -ENODATA;

595
	fs_ns = inode->i_sb->s_user_ns;
596
	size = __vfs_getxattr((struct dentry *)dentry, inode,
597
			      XATTR_NAME_CAPS, &data, XATTR_CAPS_SZ);
598
	if (size == -ENODATA || size == -EOPNOTSUPP)
599 600
		/* no data, that's ok */
		return -ENODATA;
601

602 603
	if (size < 0)
		return size;
604

605
	if (size < sizeof(magic_etc))
606 607
		return -EINVAL;

608
	cpu_caps->magic_etc = magic_etc = le32_to_cpu(caps->magic_etc);
609

610
	rootkuid = make_kuid(fs_ns, 0);
611
	switch (magic_etc & VFS_CAP_REVISION_MASK) {
612 613 614 615 616 617 618 619 620 621
	case VFS_CAP_REVISION_1:
		if (size != XATTR_CAPS_SZ_1)
			return -EINVAL;
		tocopy = VFS_CAP_U32_1;
		break;
	case VFS_CAP_REVISION_2:
		if (size != XATTR_CAPS_SZ_2)
			return -EINVAL;
		tocopy = VFS_CAP_U32_2;
		break;
622 623 624 625 626 627 628
	case VFS_CAP_REVISION_3:
		if (size != XATTR_CAPS_SZ_3)
			return -EINVAL;
		tocopy = VFS_CAP_U32_3;
		rootkuid = make_kuid(fs_ns, le32_to_cpu(nscaps->rootid));
		break;

629 630 631
	default:
		return -EINVAL;
	}
632 633 634 635 636
	/* Limit the caps to the mounter of the filesystem
	 * or the more limited uid specified in the xattr.
	 */
	if (!rootid_owns_currentns(rootkuid))
		return -ENODATA;
637

638
	CAP_FOR_EACH_U32(i) {
639 640
		if (i >= tocopy)
			break;
641 642
		cpu_caps->permitted.cap[i] = le32_to_cpu(caps->data[i].permitted);
		cpu_caps->inheritable.cap[i] = le32_to_cpu(caps->data[i].inheritable);
643
	}
644

645 646 647
	cpu_caps->permitted.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
	cpu_caps->inheritable.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;

648
	return 0;
649 650
}

David Howells's avatar
David Howells committed
651 652 653 654 655
/*
 * Attempt to get the on-exec apply capability sets for an executable file from
 * its xattrs and, if present, apply them to the proposed credentials being
 * constructed by execve().
 */
656
static int get_file_caps(struct linux_binprm *bprm, bool *effective, bool *has_fcap)
657 658
{
	int rc = 0;
659
	struct cpu_vfs_cap_data vcaps;
660

661
	cap_clear(bprm->cred->cap_permitted);
662

663 664 665
	if (!file_caps_enabled)
		return 0;

666
	if (!mnt_may_suid(bprm->file->f_path.mnt))
667
		return 0;
668 669 670 671 672 673

	/*
	 * This check is redundant with mnt_may_suid() but is kept to make
	 * explicit that capability bits are limited to s_user_ns and its
	 * descendants.
	 */
674 675
	if (!current_in_userns(bprm->file->f_path.mnt->mnt_sb->s_user_ns))
		return 0;
676

677
	rc = get_vfs_caps_from_disk(bprm->file->f_path.dentry, &vcaps);
678 679
	if (rc < 0) {
		if (rc == -EINVAL)
680 681
			printk(KERN_NOTICE "Invalid argument reading file caps for %s\n",
					bprm->filename);
682 683
		else if (rc == -ENODATA)
			rc = 0;
684 685 686
		goto out;
	}

687
	rc = bprm_caps_from_vfs_caps(&vcaps, bprm, effective, has_fcap);
688 689 690
	if (rc == -EINVAL)
		printk(KERN_NOTICE "%s: cap_from_disk returned %d for %s\n",
		       __func__, rc, bprm->filename);
691 692 693

out:
	if (rc)
694
		cap_clear(bprm->cred->cap_permitted);
695 696 697 698

	return rc;
}

699 700
static inline bool root_privileged(void) { return !issecure(SECURE_NOROOT); }

701 702 703 704 705 706 707 708 709
static inline bool __is_real(kuid_t uid, struct cred *cred)
{ return uid_eq(cred->uid, uid); }

static inline bool __is_eff(kuid_t uid, struct cred *cred)
{ return uid_eq(cred->euid, uid); }

static inline bool __is_suid(kuid_t uid, struct cred *cred)
{ return !__is_real(uid, cred) && __is_eff(uid, cred); }

710 711 712 713 714 715 716 717 718 719 720 721
/*
 * handle_privileged_root - Handle case of privileged root
 * @bprm: The execution parameters, including the proposed creds
 * @has_fcap: Are any file capabilities set?
 * @effective: Do we have effective root privilege?
 * @root_uid: This namespace' root UID WRT initial USER namespace
 *
 * Handle the case where root is privileged and hasn't been neutered by
 * SECURE_NOROOT.  If file capabilities are set, they won't be combined with
 * set UID root and nothing is changed.  If we are root, cap_permitted is
 * updated.  If we have become set UID root, the effective bit is set.
 */
722
static void handle_privileged_root(struct linux_binprm *bprm, bool has_fcap,
723 724 725 726 727
				   bool *effective, kuid_t root_uid)
{
	const struct cred *old = current_cred();
	struct cred *new = bprm->cred;

728
	if (!root_privileged())
729 730 731 732 733 734
		return;
	/*
	 * If the legacy file capability is set, then don't set privs
	 * for a setuid root binary run by a non-root user.  Do set it
	 * for a root user just to cause least surprise to an admin.
	 */
735
	if (has_fcap && __is_suid(root_uid, new)) {
736 737 738 739 740 741 742 743
		warn_setuid_and_fcaps_mixed(bprm->filename);
		return;
	}
	/*
	 * To support inheritance of root-permissions and suid-root
	 * executables under compatibility mode, we override the
	 * capability sets for the file.
	 */
744
	if (__is_eff(root_uid, new) || __is_real(root_uid, new)) {
745 746 747 748 749 750 751
		/* pP' = (cap_bset & ~0) | (pI & ~0) */
		new->cap_permitted = cap_combine(old->cap_bset,
						 old->cap_inheritable);
	}
	/*
	 * If only the real uid is 0, we do not set the effective bit.
	 */
752
	if (__is_eff(root_uid, new))
753 754 755
		*effective = true;
}

756 757 758 759 760 761
#define __cap_gained(field, target, source) \
	!cap_issubset(target->cap_##field, source->cap_##field)
#define __cap_grew(target, source, cred) \
	!cap_issubset(cred->cap_##target, cred->cap_##source)
#define __cap_full(field, cred) \
	cap_issubset(CAP_FULL_SET, cred->cap_##field)
762 763 764 765 766 767 768

static inline bool __is_setuid(struct cred *new, const struct cred *old)
{ return !uid_eq(new->euid, old->uid); }

static inline bool __is_setgid(struct cred *new, const struct cred *old)
{ return !gid_eq(new->egid, old->gid); }

769
/*
770
 * 1) Audit candidate if current->cap_effective is set
771 772 773
 *
 * We do not bother to audit if 3 things are true:
 *   1) cap_effective has all caps
774
 *   2) we became root *OR* are were already root
775 776 777 778 779
 *   3) root is supposed to have all caps (SECURE_NOROOT)
 * Since this is just a normal root execing a process.
 *
 * Number 1 above might fail if you don't have a full bset, but I think
 * that is interesting information to audit.
780 781 782 783 784
 *
 * A number of other conditions require logging:
 * 2) something prevented setuid root getting all caps
 * 3) non-setuid root gets fcaps
 * 4) non-setuid root gets ambient
785
 */
786 787
static inline bool nonroot_raised_pE(struct cred *new, const struct cred *old,
				     kuid_t root, bool has_fcap)
788 789 790
{
	bool ret = false;

791 792 793 794 795 796 797 798 799 800 801 802
	if ((__cap_grew(effective, ambient, new) &&
	     !(__cap_full(effective, new) &&
	       (__is_eff(root, new) || __is_real(root, new)) &&
	       root_privileged())) ||
	    (root_privileged() &&
	     __is_suid(root, new) &&
	     !__cap_full(effective, new)) ||
	    (!__is_setuid(new, old) &&
	     ((has_fcap &&
	       __cap_gained(permitted, new, old)) ||
	      __cap_gained(ambient, new, old))))

803
		ret = true;
804

805 806 807
	return ret;
}

David Howells's avatar
David Howells committed
808 809 810 811 812 813 814
/**
 * cap_bprm_set_creds - Set up the proposed credentials for execve().
 * @bprm: The execution parameters, including the proposed creds
 *
 * Set up the proposed credentials for a new execution context being
 * constructed by execve().  The proposed creds in @bprm->cred is altered,
 * which won't take effect immediately.  Returns 0 if successful, -ve on error.
815 816
 */
int cap_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds's avatar
Linus Torvalds committed
817
{
818 819
	const struct cred *old = current_cred();
	struct cred *new = bprm->cred;
820
	bool effective = false, has_fcap = false, is_setid;
821
	int ret;
822
	kuid_t root_uid;
Linus Torvalds's avatar
Linus Torvalds committed
823

824 825 826
	if (WARN_ON(!cap_ambient_invariant_ok(old)))
		return -EPERM;

827
	ret = get_file_caps(bprm, &effective, &has_fcap);
828 829
	if (ret < 0)
		return ret;
Linus Torvalds's avatar
Linus Torvalds committed
830

831 832
	root_uid = make_kuid(new->user_ns, 0);

833
	handle_privileged_root(bprm, has_fcap, &effective, root_uid);
834

835
	/* if we have fs caps, clear dangerous personality flags */
836
	if (__cap_gained(permitted, new, old))
837 838
		bprm->per_clear |= PER_CLEAR_ON_SETID;

839
	/* Don't let someone trace a set[ug]id/setpcap binary with the revised
840 841 842
	 * credentials unless they have the appropriate permit.
	 *
	 * In addition, if NO_NEW_PRIVS, then ensure we get no new privs.
843
	 */
844
	is_setid = __is_setuid(new, old) || __is_setgid(new, old);
845

846
	if ((is_setid || __cap_gained(permitted, new, old)) &&
847
	    ((bprm->unsafe & ~LSM_UNSAFE_PTRACE) ||
848
	     !ptracer_capable(current, new->user_ns))) {
849
		/* downgrade; they get no more than they had, and maybe less */
850
		if (!ns_capable(new->user_ns, CAP_SETUID) ||
851
		    (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)) {
852 853
			new->euid = new->uid;
			new->egid = new->gid;
Linus Torvalds's avatar
Linus Torvalds committed
854
		}
855 856
		new->cap_permitted = cap_intersect(new->cap_permitted,
						   old->cap_permitted);
Linus Torvalds's avatar
Linus Torvalds committed
857 858
	}

859 860
	new->suid = new->fsuid = new->euid;
	new->sgid = new->fsgid = new->egid;
Linus Torvalds's avatar
Linus Torvalds committed
861

862
	/* File caps or setid cancels ambient. */
863
	if (has_fcap || is_setid)
864 865 866 867 868 869 870 871 872 873 874 875
		cap_clear(new->cap_ambient);

	/*
	 * Now that we've computed pA', update pP' to give:
	 *   pP' = (X & fP) | (pI & fI) | pA'
	 */
	new->cap_permitted = cap_combine(new->cap_permitted, new->cap_ambient);

	/*
	 * Set pE' = (fE ? pP' : pA').  Because pA' is zero if fE is set,
	 * this is the same as pE' = (fE ? pP' : 0) | pA'.
	 */
876 877 878
	if (effective)
		new->cap_effective = new->cap_permitted;
	else
879 880 881 882 883
		new->cap_effective = new->cap_ambient;

	if (WARN_ON(!cap_ambient_invariant_ok(new)))
		return -EPERM;

884
	if (nonroot_raised_pE(new, old, root_uid, has_fcap)) {
885 886 887
		ret = audit_log_bprm_fcaps(bprm, new, old);
		if (ret < 0)
			return ret;
888
	}
Linus Torvalds's avatar
Linus Torvalds committed
889

890
	new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
891 892 893 894

	if (WARN_ON(!cap_ambient_invariant_ok(new)))
		return -EPERM;

895
	/* Check for privilege-elevated exec. */
896
	bprm->cap_elevated = 0;
897 898 899 900
	if (is_setid ||
	    (!__is_real(root_uid, new) &&
	     (effective ||
	      __cap_grew(permitted, ambient, new))))
901
		bprm->cap_elevated = 1;
902

903
	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
904 905
}

David Howells's avatar
David Howells committed
906 907 908 909 910 911 912 913 914 915 916 917 918 919
/**
 * cap_inode_setxattr - Determine whether an xattr may be altered
 * @dentry: The inode/dentry being altered
 * @name: The name of the xattr to be changed
 * @value: The value that the xattr will be changed to
 * @size: The size of value
 * @flags: The replacement flag
 *
 * Determine whether an xattr may be altered or set on an inode, returning 0 if
 * permission is granted, -ve if denied.
 *
 * This is used to make sure security xattrs don't get updated or set by those
 * who aren't privileged to do so.
 */
920 921
int cap_inode_setxattr(struct dentry *dentry, const char *name,
		       const void *value, size_t size, int flags)
Linus Torvalds's avatar
Linus Torvalds committed
922
{
923 924 925 926 927 928 929 930 931 932
	/* Ignore non-security xattrs */
	if (strncmp(name, XATTR_SECURITY_PREFIX,
			sizeof(XATTR_SECURITY_PREFIX) - 1) != 0)
		return 0;

	/*
	 * For XATTR_NAME_CAPS the check will be done in
	 * cap_convert_nscap(), called by setxattr()
	 */
	if (strcmp(name, XATTR_NAME_CAPS) == 0)
933
		return 0;
David Howells's avatar
David Howells committed
934

935
	if (!capable(CAP_SYS_ADMIN))
Linus Torvalds's avatar
Linus Torvalds committed
936 937 938 939
		return -EPERM;
	return 0;
}

David Howells's avatar
David Howells committed
940 941 942 943 944 945 946 947 948 949 950
/**
 * cap_inode_removexattr - Determine whether an xattr may be removed
 * @dentry: The inode/dentry being altered
 * @name: The name of the xattr to be changed
 *
 * Determine whether an xattr may be removed from an inode, returning 0 if
 * permission is granted, -ve if denied.
 *
 * This is used to make sure security xattrs don't get removed by those who
 * aren't privileged to remove them.
 */
951
int cap_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds's avatar
Linus Torvalds committed
952
{
953 954 955 956 957 958 959 960 961 962 963
	/* Ignore non-security xattrs */
	if (strncmp(name, XATTR_SECURITY_PREFIX,
			sizeof(XATTR_SECURITY_PREFIX) - 1) != 0)
		return 0;

	if (strcmp(name, XATTR_NAME_CAPS) == 0) {
		/* security.capability gets namespaced */
		struct inode *inode = d_backing_inode(dentry);
		if (!inode)
			return -EINVAL;
		if (!capable_wrt_inode_uidgid(inode, CAP_SETFCAP))
964 965
			return -EPERM;
		return 0;
David Howells's avatar
David Howells committed
966 967
	}

968
	if (!capable(CAP_SYS_ADMIN))
Linus Torvalds's avatar
Linus Torvalds committed
969 970 971 972
		return -EPERM;
	return 0;
}

973
/*
Linus Torvalds's avatar
Linus Torvalds committed
974 975 976 977 978 979 980 981 982 983 984 985 986
 * cap_emulate_setxuid() fixes the effective / permitted capabilities of
 * a process after a call to setuid, setreuid, or setresuid.
 *
 *  1) When set*uiding _from_ one of {r,e,s}uid == 0 _to_ all of
 *  {r,e,s}uid != 0, the permitted and effective capabilities are
 *  cleared.
 *
 *  2) When set*uiding _from_ euid == 0 _to_ euid != 0, the effective
 *  capabilities of the process are cleared.
 *
 *  3) When set*uiding _from_ euid != 0 _to_ euid == 0, the effective
 *  capabilities are set to the permitted capabilities.
 *
987
 *  fsuid is handled elsewhere. fsuid == 0 and {r,e,s}uid!= 0 should
Linus Torvalds's avatar
Linus Torvalds committed
988 989
 *  never happen.
 *
990
 *  -astor
Linus Torvalds's avatar
Linus Torvalds committed
991 992 993 994 995 996 997 998 999 1000 1001
 *
 * cevans - New behaviour, Oct '99
 * A process may, via prctl(), elect to keep its capabilities when it
 * calls setuid() and switches away from uid==0. Both permitted and
 * effective sets will be retained.
 * Without this change, it was impossible for a daemon to drop only some
 * of its privilege. The call to setuid(!=0) would drop all privileges!
 * Keeping uid 0 is not an option because uid 0 owns too many vital
 * files..
 * Thanks to Olaf Kirch and Peter Benie for spotting this.
 */
1002
static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)
Linus Torvalds's avatar
Linus Torvalds committed
1003
{
1004 1005 1006 1007 1008 1009 1010
	kuid_t root_uid = make_kuid(old->user_ns, 0);

	if ((uid_eq(old->uid, root_uid) ||
	     uid_eq(old->euid, root_uid) ||
	     uid_eq(old->suid, root_uid)) &&
	    (!uid_eq(new->uid, root_uid) &&
	     !uid_eq(new->euid, root_uid) &&
1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022
	     !uid_eq(new->suid, root_uid))) {
		if (!issecure(SECURE_KEEP_CAPS)) {
			cap_clear(new->cap_permitted);
			cap_clear(new->cap_effective);
		}

		/*
		 * Pre-ambient programs expect setresuid to nonroot followed
		 * by exec to drop capabilities.  We should make sure that
		 * this remains the case.
		 */
		cap_clear(new->cap_ambient);
Linus Torvalds's avatar
Linus Torvalds committed
1023
	}
1024
	if (uid_eq(old->euid, root_uid) && !uid_eq(new->euid, root_uid))
1025
		cap_clear(new->cap_effective);
1026
	if (!uid_eq(old->euid, root_uid) && uid_eq(new->euid, root_uid))
1027
		new->cap_effective = new->cap_permitted;
Linus Torvalds's avatar
Linus Torvalds committed
1028 1029
}

David Howells's avatar
David Howells committed
1030 1031 1032 1033 1034 1035 1036 1037 1038
/**
 * cap_task_fix_setuid - Fix up the results of setuid() call
 * @new: The proposed credentials
 * @old: The current task's current credentials
 * @flags: Indications of what has changed
 *
 * Fix up the results of setuid() call before the credential changes are
 * actually applied, returning 0 to grant the changes, -ve to deny them.
 */
1039
int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
Linus Torvalds's avatar
Linus Torvalds committed
1040 1041 1042 1043 1044
{
	switch (flags) {
	case LSM_SETID_RE:
	case LSM_SETID_ID:
	case LSM_SETID_RES:
David Howells's avatar
David Howells committed
1045 1046
		/* juggle the capabilities to follow [RES]UID changes unless
		 * otherwise suppressed */
1047 1048
		if (!issecure(SECURE_NO_SETUID_FIXUP))
			cap_emulate_setxuid(new, old);
Linus Torvalds's avatar
Linus Torvalds committed
1049 1050
		break;

David Howells's avatar
David Howells committed
1051 1052 1053 1054
	case LSM_SETID_FS:
		/* juggle the capabilties to follow FSUID changes, unless
		 * otherwise suppressed
		 *
1055 1056 1057 1058
		 * FIXME - is fsuser used for all CAP_FS_MASK capabilities?
		 *          if not, we might be a bit too harsh here.
		 */
		if (!issecure(SECURE_NO_SETUID_FIXUP)) {
1059 1060
			kuid_t root_uid = make_kuid(old->user_ns, 0);
			if (uid_eq(old->fsuid, root_uid) && !uid_eq(new->fsuid, root_uid))
1061 1062
				new->cap_effective =
					cap_drop_fs_set(new->cap_effective);
David Howells's avatar
David Howells committed
1063

1064
			if (!uid_eq(old->fsuid, root_uid) && uid_eq(new->fsuid, root_uid))
1065 1066 1067
				new->cap_effective =
					cap_raise_fs_set(new->cap_effective,
							 new->cap_permitted);
Linus Torvalds's avatar
Linus Torvalds committed
1068
		}
1069
		break;
David Howells's avatar
David Howells committed
1070

Linus Torvalds's avatar
Linus Torvalds committed
1071 1072 1073 1074 1075 1076 1077
	default:
		return -EINVAL;
	}

	return 0;
}

1078 1079 1080 1081 1082 1083 1084 1085 1086 1087
/*
 * Rationale: code calling task_setscheduler, task_setioprio, and
 * task_setnice, assumes that
 *   . if capable(cap_sys_nice), then those actions should be allowed
 *   . if not capable(cap_sys_nice), but acting on your own processes,
 *   	then those actions should be allowed
 * This is insufficient now since you can call code without suid, but
 * yet with increased caps.
 * So we check for increased caps on the target process.
 */
1088
static int cap_safe_nice(struct task_struct *p)
1089
{
1090
	int is_subset, ret = 0;
1091 1092 1093 1094

	rcu_read_lock();
	is_subset = cap_issubset(__task_cred(p)->cap_permitted,
				 current_cred()->cap_permitted);
1095 1096
	if (!is_subset && !ns_capable(__task_cred(p)->user_ns, CAP_SYS_NICE))
		ret = -EPERM;
1097 1098
	rcu_read_unlock();

1099
	return ret;
1100 1101
}

David Howells's avatar
David Howells committed
1102 1103 1104 1105 1106 1107 1108
/**
 * cap_task_setscheduler - Detemine if scheduler policy change is permitted
 * @p: The task to affect
 *
 * Detemine if the requested scheduler policy change is permitted for the
 * specified task, returning 0 if permission is granted, -ve if denied.
 */
1109
int cap_task_setscheduler(struct task_struct *p)
1110 1111 1112 1113
{
	return cap_safe_nice(p);
}

David Howells's avatar
David Howells committed
1114 1115 1116 1117 1118 1119 1120 1121 1122
/**
 * cap_task_ioprio - Detemine if I/O priority change is permitted
 * @p: The task to affect
 * @ioprio: The I/O priority to set
 *
 * Detemine if the requested I/O priority change is permitted for the specified
 * task, returning 0 if permission is granted, -ve if denied.
 */
int cap_task_setioprio(struct task_struct *p, int ioprio)
1123 1124 1125 1126
{
	return cap_safe_nice(p);
}

David Howells's avatar
David Howells committed
1127 1128 1129 1130 1131 1132 1133 1134 1135
/**
 * cap_task_ioprio - Detemine if task priority change is permitted
 * @p: The task to affect
 * @nice: The nice value to set
 *
 * Detemine if the requested task priority change is permitted for the
 * specified task, returning 0 if permission is granted, -ve if denied.
 */
int cap_task_setnice(struct task_struct *p, int nice)
1136 1137 1138 1139
{
	return cap_safe_nice(p);
}

1140
/*
David Howells's avatar
David Howells committed
1141 1142
 * Implement PR_CAPBSET_DROP.  Attempt to remove the specified capability from
 * the current task's bounding set.  Returns 0 on success, -ve on error.
1143
 */
1144
static int cap_prctl_drop(unsigned long cap)
1145
{
1146 1147
	struct cred *new;

1148
	if (!ns_capable(current_user_ns(), CAP_SETPCAP))
1149 1150 1151
		return -EPERM;
	if (!cap_valid(cap))
		return -EINVAL;
1152

1153 1154 1155
	new = prepare_creds();
	if (!new)
		return -ENOMEM;
1156
	cap_lower(new->cap_bset, cap);
1157
	return commit_creds(new);
1158
}
1159

David Howells's avatar
David Howells committed
1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171
/**
 * cap_task_prctl - Implement process control functions for this security module
 * @option: The process control function requested
 * @arg2, @arg3, @arg4, @arg5: The argument data for this function
 *
 * Allow process control functions (sys_prctl()) to alter capabilities; may
 * also deny access to other functions not otherwise implemented here.
 *
 * Returns 0 or +ve on success, -ENOSYS if this function is not implemented
 * here, other -ve on error.  If -ENOSYS is returned, sys_prctl() and other LSM
 * modules will consider performing the function.
 */
1172
int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
1173
		   unsigned long arg4, unsigned long arg5)
1174
{
1175
	const struct cred *old = current_cred();
1176 1177
	struct cred *new;

1178 1179 1180
	switch (option) {
	case PR_CAPBSET_READ:
		if (!cap_valid(arg2))
1181 1182
			return -EINVAL;
		return !!cap_raised(old->cap_bset, arg2);
1183

1184
	case PR_CAPBSET_DROP:
1185
		return cap_prctl_drop(arg2);
1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206

	/*
	 * The next four prctl's remain to assist with transitioning a
	 * system from legacy UID=0 based privilege (when filesystem
	 * capabilities are not in use) to a system using filesystem
	 * capabilities only - as the POSIX.1e draft intended.
	 *
	 * Note:
	 *
	 *  PR_SET_SECUREBITS =
	 *      issecure_mask(SECURE_KEEP_CAPS_LOCKED)
	 *    | issecure_mask(SECURE_NOROOT)
	 *    | issecure_mask(SECURE_NOROOT_LOCKED)
	 *    | issecure_mask(SECURE_NO_SETUID_FIXUP)
	 *    | issecure_mask(SECURE_NO_SETUID_FIXUP_LOCKED)
	 *
	 * will ensure that the current process and all of its
	 * children will be locked into a pure
	 * capability-based-privilege environment.
	 */
	case PR_SET_SECUREBITS:
1207 1208 1209
		if ((((old->securebits & SECURE_ALL_LOCKS) >> 1)
		     & (old->securebits ^ arg2))			/*[1]*/
		    || ((old->securebits & SECURE_ALL_LOCKS & ~arg2))	/*[2]*/
1210
		    || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS))	/*[3]*/
1211
		    || (cap_capable(current_cred(),
1212
				    current_cred()->user_ns, CAP_SETPCAP,
1213
				    SECURITY_CAP_AUDIT) != 0)		/*[4]*/
1214 1215 1216 1217 1218 1219 1220
			/*
			 * [1] no changing of bits that are locked
			 * [2] no unlocking of locks
			 * [3] no setting of unsupported bits
			 * [4] doing anything requires privilege (go read about
			 *     the "sendmail capabilities bug")
			 */
1221 1222
		    )
			/* cannot change a locked bit */
1223 1224 1225 1226 1227
			return -EPERM;

		new = prepare_creds();
		if (!new)
			return -ENOMEM;
1228
		new->securebits = arg2;
1229
		return commit_creds(new);
1230

1231
	case PR_GET_SECUREBITS:
1232
		return old->securebits;
1233 1234

	case PR_GET_KEEPCAPS:
1235
		return !!issecure(SECURE_KEEP_CAPS);
1236

1237 1238
	case PR_SET_KEEPCAPS:
		if (arg2 > 1) /* Note, we rely on arg2 being unsigned here */
1239
			return -EINVAL;
1240
		if (issecure(SECURE_KEEP_CAPS_LOCKED))
1241 1242 1243 1244 1245
			return -EPERM;

		new = prepare_creds();
		if (!new)
			return -ENOMEM;
1246 1247
		if (arg2)
			new->securebits |= issecure_mask(SECURE_KEEP_CAPS);
1248
		else
1249
			new->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
1250
		return commit_creds(new);
1251

1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275
	case PR_CAP_AMBIENT:
		if (arg2 == PR_CAP_AMBIENT_CLEAR_ALL) {
			if (arg3 | arg4 | arg5)
				return -EINVAL;

			new = prepare_creds();
			if (!new)
				return -ENOMEM;
			cap_clear(new->cap_ambient);
			return commit_creds(new);
		}

		if (((!cap_valid(arg3)) | arg4 | arg5))
			return -EINVAL;

		if (arg2 == PR_CAP_AMBIENT_IS_SET) {
			return !!cap_raised(current_cred()->cap_ambient, arg3);
		} else if (arg2 != PR_CAP_AMBIENT_RAISE &&
			   arg2 != PR_CAP_AMBIENT_LOWER) {
			return -EINVAL;
		} else {
			if (arg2 == PR_CAP_AMBIENT_RAISE &&
			    (!cap_raised(current_cred()->cap_permitted, arg3) ||
			     !cap_raised(current_cred()->cap_inheritable,
1276 1277
					 arg3) ||
			     issecure(SECURE_NO_CAP_AMBIENT_RAISE)))
1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289
				return -EPERM;

			new = prepare_creds();
			if (!new)
				return -ENOMEM;
			if (arg2 == PR_CAP_AMBIENT_RAISE)
				cap_raise(new->cap_ambient, arg3);
			else
				cap_lower(new->cap_ambient, arg3);
			return commit_creds(new);
		}

1290 1291
	default:
		/* No functionality available - continue with default */
1292
		return -ENOSYS;
1293
	}
Linus Torvalds's avatar
Linus Torvalds committed
1294 1295
}

David Howells's avatar
David Howells committed
1296 1297 1298 1299 1300 1301
/**
 * cap_vm_enough_memory - Determine whether a new virtual mapping is permitted
 * @mm: The VM space in which the new mapping is to be made
 * @pages: The size of the mapping
 *
 * Determine whether the allocation of a new virtual mapping by the current
1302
 * task is permitted, returning 1 if permission is granted, 0 if not.
David Howells's avatar
David Howells committed
1303
 */
1304
int cap_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds's avatar
Linus Torvalds committed
1305 1306 1307
{
	int cap_sys_admin = 0;

1308
	if (cap_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
1309
			SECURITY_CAP_NOAUDIT) == 0)
Linus Torvalds's avatar
Linus Torvalds committed
1310
		cap_sys_admin = 1;
1311
	return cap_sys_admin;
Linus Torvalds's avatar
Linus Torvalds committed
1312
}
1313 1314

/*
1315
 * cap_mmap_addr - check if able to map given addr
1316 1317
 * @addr: address attempting to be mapped
 *
1318
 * If the process is attempting to map memory below dac_mmap_min_addr they need