1 // Copyright (C) 2016 The Android Open Source Project
2 //
3 // Licensed under the Apache License, Version 2.0 (the "License");
4 // you may not use this file except in compliance with the License.
5 // You may obtain a copy of the License at
6 //
7 //      http://www.apache.org/licenses/LICENSE-2.0
8 //
9 // Unless required by applicable law or agreed to in writing, software
10 // distributed under the License is distributed on an "AS IS" BASIS,
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12 // See the License for the specific language governing permissions and
13 // limitations under the License.
14 
15 #include "capabilities.h"
16 
17 #include <sys/prctl.h>
18 
19 #include <map>
20 #include <memory>
21 
22 #include <android-base/logging.h>
23 #include <android-base/macros.h>
24 
25 #define CAP_MAP_ENTRY(cap) { #cap, CAP_##cap }
26 
27 namespace android {
28 namespace init {
29 
30 static const std::map<std::string, int> cap_map = {
31     CAP_MAP_ENTRY(CHOWN),
32     CAP_MAP_ENTRY(DAC_OVERRIDE),
33     CAP_MAP_ENTRY(DAC_READ_SEARCH),
34     CAP_MAP_ENTRY(FOWNER),
35     CAP_MAP_ENTRY(FSETID),
36     CAP_MAP_ENTRY(KILL),
37     CAP_MAP_ENTRY(SETGID),
38     CAP_MAP_ENTRY(SETUID),
39     CAP_MAP_ENTRY(SETPCAP),
40     CAP_MAP_ENTRY(LINUX_IMMUTABLE),
41     CAP_MAP_ENTRY(NET_BIND_SERVICE),
42     CAP_MAP_ENTRY(NET_BROADCAST),
43     CAP_MAP_ENTRY(NET_ADMIN),
44     CAP_MAP_ENTRY(NET_RAW),
45     CAP_MAP_ENTRY(IPC_LOCK),
46     CAP_MAP_ENTRY(IPC_OWNER),
47     CAP_MAP_ENTRY(SYS_MODULE),
48     CAP_MAP_ENTRY(SYS_RAWIO),
49     CAP_MAP_ENTRY(SYS_CHROOT),
50     CAP_MAP_ENTRY(SYS_PTRACE),
51     CAP_MAP_ENTRY(SYS_PACCT),
52     CAP_MAP_ENTRY(SYS_ADMIN),
53     CAP_MAP_ENTRY(SYS_BOOT),
54     CAP_MAP_ENTRY(SYS_NICE),
55     CAP_MAP_ENTRY(SYS_RESOURCE),
56     CAP_MAP_ENTRY(SYS_TIME),
57     CAP_MAP_ENTRY(SYS_TTY_CONFIG),
58     CAP_MAP_ENTRY(MKNOD),
59     CAP_MAP_ENTRY(LEASE),
60     CAP_MAP_ENTRY(AUDIT_WRITE),
61     CAP_MAP_ENTRY(AUDIT_CONTROL),
62     CAP_MAP_ENTRY(SETFCAP),
63     CAP_MAP_ENTRY(MAC_OVERRIDE),
64     CAP_MAP_ENTRY(MAC_ADMIN),
65     CAP_MAP_ENTRY(SYSLOG),
66     CAP_MAP_ENTRY(WAKE_ALARM),
67     CAP_MAP_ENTRY(BLOCK_SUSPEND),
68     CAP_MAP_ENTRY(AUDIT_READ),
69 };
70 
71 static_assert(CAP_LAST_CAP == CAP_AUDIT_READ, "CAP_LAST_CAP is not CAP_AUDIT_READ");
72 
73 static bool ComputeCapAmbientSupported() {
74 #if defined(__ANDROID__)
75     return prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) >= 0;
76 #else
77     return true;
78 #endif
79 }
80 
81 static unsigned int ComputeLastValidCap() {
82 #if defined(__ANDROID__)
83     // Android does not support kernels < 3.8. 'CAP_WAKE_ALARM' has been present since 3.0, see
84     // http://lxr.free-electrons.com/source/include/linux/capability.h?v=3.0#L360.
85     unsigned int last_valid_cap = CAP_WAKE_ALARM;
86     for (; prctl(PR_CAPBSET_READ, last_valid_cap, 0, 0, 0) >= 0; ++last_valid_cap);
87 
88     // |last_valid_cap| will be the first failing value.
89     return last_valid_cap - 1;
90 #else
91     return CAP_LAST_CAP;
92 #endif
93 }
94 
95 static bool DropBoundingSet(const CapSet& to_keep) {
96     unsigned int last_valid_cap = GetLastValidCap();
97     // When dropping the bounding set, attempt to drop capabilities reported at
98     // run-time, not at compile-time.
99     // If the run-time kernel is older than the compile-time headers, this
100     // avoids dropping an invalid capability. If the run-time kernel is newer
101     // than the headers, this guarantees all capabilities (even those unknown at
102     // compile time) will be dropped.
103     for (size_t cap = 0; cap <= last_valid_cap; ++cap) {
104         if (cap < to_keep.size() && to_keep.test(cap)) {
105             // No need to drop this capability.
106             continue;
107         }
108         if (cap_drop_bound(cap) == -1) {
109             PLOG(ERROR) << "cap_drop_bound(" << cap << ") failed";
110             return false;
111         }
112     }
113     return true;
114 }
115 
116 static bool SetProcCaps(const CapSet& to_keep, bool add_setpcap) {
117     ScopedCaps caps(cap_init());
118 
119     cap_clear(caps.get());
120     cap_value_t value[1];
121     for (size_t cap = 0; cap < to_keep.size(); ++cap) {
122         if (to_keep.test(cap)) {
123             value[0] = cap;
124             if (cap_set_flag(caps.get(), CAP_INHERITABLE, arraysize(value), value, CAP_SET) != 0 ||
125                 cap_set_flag(caps.get(), CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0) {
126                 PLOG(ERROR) << "cap_set_flag(INHERITABLE|PERMITTED, " << cap << ") failed";
127                 return false;
128             }
129         }
130     }
131 
132     if (add_setpcap) {
133         value[0] = CAP_SETPCAP;
134         if (cap_set_flag(caps.get(), CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0 ||
135             cap_set_flag(caps.get(), CAP_EFFECTIVE, arraysize(value), value, CAP_SET) != 0) {
136             PLOG(ERROR) << "cap_set_flag(PERMITTED|EFFECTIVE, " << CAP_SETPCAP << ") failed";
137             return false;
138         }
139     }
140 
141     if (cap_set_proc(caps.get()) != 0) {
142         PLOG(ERROR) << "cap_set_proc(" << to_keep.to_ulong() << ") failed";
143         return false;
144     }
145     return true;
146 }
147 
148 static bool SetAmbientCaps(const CapSet& to_raise) {
149 #if defined(__ANDROID__)
150     for (size_t cap = 0; cap < to_raise.size(); ++cap) {
151         if (to_raise.test(cap)) {
152             if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0) != 0) {
153                 PLOG(ERROR) << "prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, " << cap << ") failed";
154                 return false;
155             }
156         }
157     }
158 #endif
159     return true;
160 }
161 
162 int LookupCap(const std::string& cap_name) {
163     auto e = cap_map.find(cap_name);
164     if (e != cap_map.end()) {
165         return e->second;
166     } else {
167         return -1;
168     }
169 }
170 
171 bool CapAmbientSupported() {
172     static bool cap_ambient_supported = ComputeCapAmbientSupported();
173     return cap_ambient_supported;
174 }
175 
176 unsigned int GetLastValidCap() {
177     static unsigned int last_valid_cap = ComputeLastValidCap();
178     return last_valid_cap;
179 }
180 
181 bool SetCapsForExec(const CapSet& to_keep) {
182     // Need to keep SETPCAP to drop bounding set below.
183     bool add_setpcap = true;
184     if (!SetProcCaps(to_keep, add_setpcap)) {
185         LOG(ERROR) << "failed to apply initial capset";
186         return false;
187     }
188 
189     if (!DropBoundingSet(to_keep)) {
190         return false;
191     }
192 
193     // If SETPCAP wasn't specifically requested, drop it now.
194     add_setpcap = false;
195     if (!SetProcCaps(to_keep, add_setpcap)) {
196         LOG(ERROR) << "failed to apply final capset";
197         return false;
198     }
199 
200     // Add the capabilities to the ambient set so that they are preserved across
201     // execve(2).
202     // See http://man7.org/linux/man-pages/man7/capabilities.7.html.
203     return SetAmbientCaps(to_keep);
204 }
205 
206 bool DropInheritableCaps() {
207     ScopedCaps caps(cap_get_proc());
208     if (cap_clear_flag(caps.get(), CAP_INHERITABLE) == -1) {
209         PLOG(ERROR) << "cap_clear_flag(INHERITABLE) failed";
210         return false;
211     }
212     if (cap_set_proc(caps.get()) != 0) {
213         PLOG(ERROR) << "cap_set_proc() failed";
214         return false;
215     }
216     return true;
217 }
218 
219 }  // namespace init
220 }  // namespace android
221