1 // Copyright (C) 2016 The Android Open Source Project
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "capabilities.h"
16
17 #include <sys/prctl.h>
18
19 #include <map>
20 #include <memory>
21
22 #include <android-base/logging.h>
23 #include <android-base/macros.h>
24
25 #define CAP_MAP_ENTRY(cap) { #cap, CAP_##cap }
26
27 namespace android {
28 namespace init {
29
30 static const std::map<std::string, int> cap_map = {
31 CAP_MAP_ENTRY(CHOWN),
32 CAP_MAP_ENTRY(DAC_OVERRIDE),
33 CAP_MAP_ENTRY(DAC_READ_SEARCH),
34 CAP_MAP_ENTRY(FOWNER),
35 CAP_MAP_ENTRY(FSETID),
36 CAP_MAP_ENTRY(KILL),
37 CAP_MAP_ENTRY(SETGID),
38 CAP_MAP_ENTRY(SETUID),
39 CAP_MAP_ENTRY(SETPCAP),
40 CAP_MAP_ENTRY(LINUX_IMMUTABLE),
41 CAP_MAP_ENTRY(NET_BIND_SERVICE),
42 CAP_MAP_ENTRY(NET_BROADCAST),
43 CAP_MAP_ENTRY(NET_ADMIN),
44 CAP_MAP_ENTRY(NET_RAW),
45 CAP_MAP_ENTRY(IPC_LOCK),
46 CAP_MAP_ENTRY(IPC_OWNER),
47 CAP_MAP_ENTRY(SYS_MODULE),
48 CAP_MAP_ENTRY(SYS_RAWIO),
49 CAP_MAP_ENTRY(SYS_CHROOT),
50 CAP_MAP_ENTRY(SYS_PTRACE),
51 CAP_MAP_ENTRY(SYS_PACCT),
52 CAP_MAP_ENTRY(SYS_ADMIN),
53 CAP_MAP_ENTRY(SYS_BOOT),
54 CAP_MAP_ENTRY(SYS_NICE),
55 CAP_MAP_ENTRY(SYS_RESOURCE),
56 CAP_MAP_ENTRY(SYS_TIME),
57 CAP_MAP_ENTRY(SYS_TTY_CONFIG),
58 CAP_MAP_ENTRY(MKNOD),
59 CAP_MAP_ENTRY(LEASE),
60 CAP_MAP_ENTRY(AUDIT_WRITE),
61 CAP_MAP_ENTRY(AUDIT_CONTROL),
62 CAP_MAP_ENTRY(SETFCAP),
63 CAP_MAP_ENTRY(MAC_OVERRIDE),
64 CAP_MAP_ENTRY(MAC_ADMIN),
65 CAP_MAP_ENTRY(SYSLOG),
66 CAP_MAP_ENTRY(WAKE_ALARM),
67 CAP_MAP_ENTRY(BLOCK_SUSPEND),
68 CAP_MAP_ENTRY(AUDIT_READ),
69 #if defined(__BIONIC__)
70 CAP_MAP_ENTRY(PERFMON),
71 CAP_MAP_ENTRY(BPF),
72 CAP_MAP_ENTRY(CHECKPOINT_RESTORE),
73 #endif
74 };
75
76 #if defined(__BIONIC__)
77 static_assert(CAP_LAST_CAP == CAP_CHECKPOINT_RESTORE, "CAP_LAST_CAP is not CAP_CHECKPOINT_RESTORE");
78 #else
79 static_assert(CAP_LAST_CAP == CAP_AUDIT_READ, "CAP_LAST_CAP is not CAP_AUDIT_READ");
80 #endif
81
ComputeCapAmbientSupported()82 static bool ComputeCapAmbientSupported() {
83 #if defined(__ANDROID__)
84 return prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) >= 0;
85 #else
86 return true;
87 #endif
88 }
89
ComputeLastValidCap()90 static unsigned int ComputeLastValidCap() {
91 #if defined(__ANDROID__)
92 // Android does not support kernels < 3.8. 'CAP_WAKE_ALARM' has been present since 3.0, see
93 // http://lxr.free-electrons.com/source/include/linux/capability.h?v=3.0#L360.
94 unsigned int last_valid_cap = CAP_WAKE_ALARM;
95 for (; prctl(PR_CAPBSET_READ, last_valid_cap, 0, 0, 0) >= 0; ++last_valid_cap);
96
97 // |last_valid_cap| will be the first failing value.
98 return last_valid_cap - 1;
99 #else
100 return CAP_LAST_CAP;
101 #endif
102 }
103
DropBoundingSet(const CapSet & to_keep)104 static bool DropBoundingSet(const CapSet& to_keep) {
105 unsigned int last_valid_cap = GetLastValidCap();
106 // When dropping the bounding set, attempt to drop capabilities reported at
107 // run-time, not at compile-time.
108 // If the run-time kernel is older than the compile-time headers, this
109 // avoids dropping an invalid capability. If the run-time kernel is newer
110 // than the headers, this guarantees all capabilities (even those unknown at
111 // compile time) will be dropped.
112 for (size_t cap = 0; cap <= last_valid_cap; ++cap) {
113 if (cap < to_keep.size() && to_keep.test(cap)) {
114 // No need to drop this capability.
115 continue;
116 }
117 if (cap_drop_bound(cap) == -1) {
118 PLOG(ERROR) << "cap_drop_bound(" << cap << ") failed";
119 return false;
120 }
121 }
122 return true;
123 }
124
SetProcCaps(const CapSet & to_keep,bool add_setpcap)125 static bool SetProcCaps(const CapSet& to_keep, bool add_setpcap) {
126 ScopedCaps caps(cap_init());
127
128 cap_clear(caps.get());
129 cap_value_t value[1];
130 for (size_t cap = 0; cap < to_keep.size(); ++cap) {
131 if (to_keep.test(cap)) {
132 value[0] = cap;
133 if (cap_set_flag(caps.get(), CAP_INHERITABLE, arraysize(value), value, CAP_SET) != 0 ||
134 cap_set_flag(caps.get(), CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0) {
135 PLOG(ERROR) << "cap_set_flag(INHERITABLE|PERMITTED, " << cap << ") failed";
136 return false;
137 }
138 }
139 }
140
141 if (add_setpcap) {
142 value[0] = CAP_SETPCAP;
143 if (cap_set_flag(caps.get(), CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0 ||
144 cap_set_flag(caps.get(), CAP_EFFECTIVE, arraysize(value), value, CAP_SET) != 0) {
145 PLOG(ERROR) << "cap_set_flag(PERMITTED|EFFECTIVE, " << CAP_SETPCAP << ") failed";
146 return false;
147 }
148 }
149
150 if (cap_set_proc(caps.get()) != 0) {
151 PLOG(ERROR) << "cap_set_proc(" << to_keep.to_ulong() << ") failed";
152 return false;
153 }
154 return true;
155 }
156
SetAmbientCaps(const CapSet & to_raise)157 static bool SetAmbientCaps(const CapSet& to_raise) {
158 #if defined(__ANDROID__)
159 for (size_t cap = 0; cap < to_raise.size(); ++cap) {
160 if (to_raise.test(cap)) {
161 if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0) != 0) {
162 PLOG(ERROR) << "prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, " << cap << ") failed";
163 return false;
164 }
165 }
166 }
167 #endif
168 return true;
169 }
170
LookupCap(const std::string & cap_name)171 int LookupCap(const std::string& cap_name) {
172 auto e = cap_map.find(cap_name);
173 if (e != cap_map.end()) {
174 return e->second;
175 } else {
176 return -1;
177 }
178 }
179
CapAmbientSupported()180 bool CapAmbientSupported() {
181 static bool cap_ambient_supported = ComputeCapAmbientSupported();
182 return cap_ambient_supported;
183 }
184
GetLastValidCap()185 unsigned int GetLastValidCap() {
186 static unsigned int last_valid_cap = ComputeLastValidCap();
187 return last_valid_cap;
188 }
189
SetCapsForExec(const CapSet & to_keep)190 bool SetCapsForExec(const CapSet& to_keep) {
191 // Need to keep SETPCAP to drop bounding set below.
192 bool add_setpcap = true;
193 if (!SetProcCaps(to_keep, add_setpcap)) {
194 LOG(ERROR) << "failed to apply initial capset";
195 return false;
196 }
197
198 if (!DropBoundingSet(to_keep)) {
199 return false;
200 }
201
202 // If SETPCAP wasn't specifically requested, drop it now.
203 add_setpcap = false;
204 if (!SetProcCaps(to_keep, add_setpcap)) {
205 LOG(ERROR) << "failed to apply final capset";
206 return false;
207 }
208
209 // Add the capabilities to the ambient set so that they are preserved across
210 // execve(2).
211 // See http://man7.org/linux/man-pages/man7/capabilities.7.html.
212 return SetAmbientCaps(to_keep);
213 }
214
DropInheritableCaps()215 bool DropInheritableCaps() {
216 ScopedCaps caps(cap_get_proc());
217 if (cap_clear_flag(caps.get(), CAP_INHERITABLE) == -1) {
218 PLOG(ERROR) << "cap_clear_flag(INHERITABLE) failed";
219 return false;
220 }
221 if (cap_set_proc(caps.get()) != 0) {
222 PLOG(ERROR) << "cap_set_proc() failed";
223 return false;
224 }
225 return true;
226 }
227
228 } // namespace init
229 } // namespace android
230