1 // Copyright (C) 2016 The Android Open Source Project
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 // http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14
15 #include "capabilities.h"
16
17 #include <sys/capability.h>
18 #include <sys/prctl.h>
19
20 #include <map>
21 #include <memory>
22
23 #include <android-base/logging.h>
24 #include <android-base/macros.h>
25
26 #define CAP_MAP_ENTRY(cap) { #cap, CAP_##cap }
27
28 static const std::map<std::string, int> cap_map = {
29 CAP_MAP_ENTRY(CHOWN),
30 CAP_MAP_ENTRY(DAC_OVERRIDE),
31 CAP_MAP_ENTRY(DAC_READ_SEARCH),
32 CAP_MAP_ENTRY(FOWNER),
33 CAP_MAP_ENTRY(FSETID),
34 CAP_MAP_ENTRY(KILL),
35 CAP_MAP_ENTRY(SETGID),
36 CAP_MAP_ENTRY(SETUID),
37 CAP_MAP_ENTRY(SETPCAP),
38 CAP_MAP_ENTRY(LINUX_IMMUTABLE),
39 CAP_MAP_ENTRY(NET_BIND_SERVICE),
40 CAP_MAP_ENTRY(NET_BROADCAST),
41 CAP_MAP_ENTRY(NET_ADMIN),
42 CAP_MAP_ENTRY(NET_RAW),
43 CAP_MAP_ENTRY(IPC_LOCK),
44 CAP_MAP_ENTRY(IPC_OWNER),
45 CAP_MAP_ENTRY(SYS_MODULE),
46 CAP_MAP_ENTRY(SYS_RAWIO),
47 CAP_MAP_ENTRY(SYS_CHROOT),
48 CAP_MAP_ENTRY(SYS_PTRACE),
49 CAP_MAP_ENTRY(SYS_PACCT),
50 CAP_MAP_ENTRY(SYS_ADMIN),
51 CAP_MAP_ENTRY(SYS_BOOT),
52 CAP_MAP_ENTRY(SYS_NICE),
53 CAP_MAP_ENTRY(SYS_RESOURCE),
54 CAP_MAP_ENTRY(SYS_TIME),
55 CAP_MAP_ENTRY(SYS_TTY_CONFIG),
56 CAP_MAP_ENTRY(MKNOD),
57 CAP_MAP_ENTRY(LEASE),
58 CAP_MAP_ENTRY(AUDIT_WRITE),
59 CAP_MAP_ENTRY(AUDIT_CONTROL),
60 CAP_MAP_ENTRY(SETFCAP),
61 CAP_MAP_ENTRY(MAC_OVERRIDE),
62 CAP_MAP_ENTRY(MAC_ADMIN),
63 CAP_MAP_ENTRY(SYSLOG),
64 CAP_MAP_ENTRY(WAKE_ALARM),
65 CAP_MAP_ENTRY(BLOCK_SUSPEND),
66 CAP_MAP_ENTRY(AUDIT_READ),
67 };
68
69 static_assert(CAP_LAST_CAP == CAP_AUDIT_READ, "CAP_LAST_CAP is not CAP_AUDIT_READ");
70
ComputeCapAmbientSupported()71 static bool ComputeCapAmbientSupported() {
72 return prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) >= 0;
73 }
74
ComputeLastValidCap()75 static unsigned int ComputeLastValidCap() {
76 // Android does not support kernels < 3.8. 'CAP_WAKE_ALARM' has been present since 3.0, see
77 // http://lxr.free-electrons.com/source/include/linux/capability.h?v=3.0#L360.
78 unsigned int last_valid_cap = CAP_WAKE_ALARM;
79 for (; prctl(PR_CAPBSET_READ, last_valid_cap, 0, 0, 0) >= 0; ++last_valid_cap);
80
81 // |last_valid_cap| will be the first failing value.
82 return last_valid_cap - 1;
83 }
84
DropBoundingSet(const CapSet & to_keep)85 static bool DropBoundingSet(const CapSet& to_keep) {
86 unsigned int last_valid_cap = GetLastValidCap();
87 // When dropping the bounding set, attempt to drop capabilities reported at
88 // run-time, not at compile-time.
89 // If the run-time kernel is older than the compile-time headers, this
90 // avoids dropping an invalid capability. If the run-time kernel is newer
91 // than the headers, this guarantees all capabilities (even those unknown at
92 // compile time) will be dropped.
93 for (size_t cap = 0; cap <= last_valid_cap; ++cap) {
94 if (cap < to_keep.size() && to_keep.test(cap)) {
95 // No need to drop this capability.
96 continue;
97 }
98 if (cap_drop_bound(cap) == -1) {
99 PLOG(ERROR) << "cap_drop_bound(" << cap << ") failed";
100 return false;
101 }
102 }
103 return true;
104 }
105
SetProcCaps(const CapSet & to_keep,bool add_setpcap)106 static bool SetProcCaps(const CapSet& to_keep, bool add_setpcap) {
107 cap_t caps = cap_init();
108 auto deleter = [](cap_t* p) { cap_free(*p); };
109 std::unique_ptr<cap_t, decltype(deleter)> ptr_caps(&caps, deleter);
110
111 cap_clear(caps);
112 cap_value_t value[1];
113 for (size_t cap = 0; cap < to_keep.size(); ++cap) {
114 if (to_keep.test(cap)) {
115 value[0] = cap;
116 if (cap_set_flag(caps, CAP_INHERITABLE, arraysize(value), value, CAP_SET) != 0 ||
117 cap_set_flag(caps, CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0) {
118 PLOG(ERROR) << "cap_set_flag(INHERITABLE|PERMITTED, " << cap << ") failed";
119 return false;
120 }
121 }
122 }
123
124 if (add_setpcap) {
125 value[0] = CAP_SETPCAP;
126 if (cap_set_flag(caps, CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0 ||
127 cap_set_flag(caps, CAP_EFFECTIVE, arraysize(value), value, CAP_SET) != 0) {
128 PLOG(ERROR) << "cap_set_flag(PERMITTED|EFFECTIVE, " << CAP_SETPCAP << ") failed";
129 return false;
130 }
131 }
132
133 if (cap_set_proc(caps) != 0) {
134 PLOG(ERROR) << "cap_set_proc(" << to_keep.to_ulong() << ") failed";
135 return false;
136 }
137 return true;
138 }
139
SetAmbientCaps(const CapSet & to_raise)140 static bool SetAmbientCaps(const CapSet& to_raise) {
141 for (size_t cap = 0; cap < to_raise.size(); ++cap) {
142 if (to_raise.test(cap)) {
143 if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0) != 0) {
144 PLOG(ERROR) << "prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, " << cap << ") failed";
145 return false;
146 }
147 }
148 }
149 return true;
150 }
151
LookupCap(const std::string & cap_name)152 int LookupCap(const std::string& cap_name) {
153 auto e = cap_map.find(cap_name);
154 if (e != cap_map.end()) {
155 return e->second;
156 } else {
157 return -1;
158 }
159 }
160
CapAmbientSupported()161 bool CapAmbientSupported() {
162 static bool cap_ambient_supported = ComputeCapAmbientSupported();
163 return cap_ambient_supported;
164 }
165
GetLastValidCap()166 unsigned int GetLastValidCap() {
167 static unsigned int last_valid_cap = ComputeLastValidCap();
168 return last_valid_cap;
169 }
170
SetCapsForExec(const CapSet & to_keep)171 bool SetCapsForExec(const CapSet& to_keep) {
172 // Need to keep SETPCAP to drop bounding set below.
173 bool add_setpcap = true;
174 if (!SetProcCaps(to_keep, add_setpcap)) {
175 LOG(ERROR) << "failed to apply initial capset";
176 return false;
177 }
178
179 if (!DropBoundingSet(to_keep)) {
180 return false;
181 }
182
183 // If SETPCAP wasn't specifically requested, drop it now.
184 add_setpcap = false;
185 if (!SetProcCaps(to_keep, add_setpcap)) {
186 LOG(ERROR) << "failed to apply final capset";
187 return false;
188 }
189
190 // Add the capabilities to the ambient set so that they are preserved across
191 // execve(2).
192 // See http://man7.org/linux/man-pages/man7/capabilities.7.html.
193 return SetAmbientCaps(to_keep);
194 }
195