1 // SPDX-License-Identifier: GPL-2.0 1 // SPDX-License-Identifier: GPL-2.0
2 /* 2 /*
3 * linux/kernel/capability.c 3 * linux/kernel/capability.c
4 * 4 *
5 * Copyright (C) 1997 Andrew Main <zefram@fys 5 * Copyright (C) 1997 Andrew Main <zefram@fysh.org>
6 * 6 *
7 * Integrated into 2.1.97+, Andrew G. Morgan 7 * Integrated into 2.1.97+, Andrew G. Morgan <morgan@kernel.org>
8 * 30 May 2002: Cleanup, Robert M. Love <rml@t 8 * 30 May 2002: Cleanup, Robert M. Love <rml@tech9.net>
9 */ 9 */
10 10
11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 11 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
12 12
13 #include <linux/audit.h> 13 #include <linux/audit.h>
14 #include <linux/capability.h> 14 #include <linux/capability.h>
15 #include <linux/mm.h> 15 #include <linux/mm.h>
16 #include <linux/export.h> 16 #include <linux/export.h>
17 #include <linux/security.h> 17 #include <linux/security.h>
18 #include <linux/syscalls.h> 18 #include <linux/syscalls.h>
19 #include <linux/pid_namespace.h> 19 #include <linux/pid_namespace.h>
20 #include <linux/user_namespace.h> 20 #include <linux/user_namespace.h>
21 #include <linux/uaccess.h> 21 #include <linux/uaccess.h>
22 22
23 int file_caps_enabled = 1; 23 int file_caps_enabled = 1;
24 24
25 static int __init file_caps_disable(char *str) 25 static int __init file_caps_disable(char *str)
26 { 26 {
27 file_caps_enabled = 0; 27 file_caps_enabled = 0;
28 return 1; 28 return 1;
29 } 29 }
30 __setup("no_file_caps", file_caps_disable); 30 __setup("no_file_caps", file_caps_disable);
31 31
32 #ifdef CONFIG_MULTIUSER 32 #ifdef CONFIG_MULTIUSER
33 /* 33 /*
34 * More recent versions of libcap are availabl 34 * More recent versions of libcap are available from:
35 * 35 *
36 * http://www.kernel.org/pub/linux/libs/secu 36 * http://www.kernel.org/pub/linux/libs/security/linux-privs/
37 */ 37 */
38 38
39 static void warn_legacy_capability_use(void) 39 static void warn_legacy_capability_use(void)
40 { 40 {
41 char name[sizeof(current->comm)]; 41 char name[sizeof(current->comm)];
42 42
43 pr_info_once("warning: `%s' uses 32-bi 43 pr_info_once("warning: `%s' uses 32-bit capabilities (legacy support in use)\n",
44 get_task_comm(name, curre 44 get_task_comm(name, current));
45 } 45 }
46 46
47 /* 47 /*
48 * Version 2 capabilities worked fine, but the 48 * Version 2 capabilities worked fine, but the linux/capability.h file
49 * that accompanied their introduction encoura 49 * that accompanied their introduction encouraged their use without
50 * the necessary user-space source code change 50 * the necessary user-space source code changes. As such, we have
51 * created a version 3 with equivalent functio 51 * created a version 3 with equivalent functionality to version 2, but
52 * with a header change to protect legacy sour 52 * with a header change to protect legacy source code from using
53 * version 2 when it wanted to use version 1. 53 * version 2 when it wanted to use version 1. If your system has code
54 * that trips the following warning, it is usi 54 * that trips the following warning, it is using version 2 specific
55 * capabilities and may be doing so insecurely 55 * capabilities and may be doing so insecurely.
56 * 56 *
57 * The remedy is to either upgrade your versio 57 * The remedy is to either upgrade your version of libcap (to 2.10+,
58 * if the application is linked against it), o 58 * if the application is linked against it), or recompile your
59 * application with modern kernel headers and 59 * application with modern kernel headers and this warning will go
60 * away. 60 * away.
61 */ 61 */
62 62
63 static void warn_deprecated_v2(void) 63 static void warn_deprecated_v2(void)
64 { 64 {
65 char name[sizeof(current->comm)]; 65 char name[sizeof(current->comm)];
66 66
67 pr_info_once("warning: `%s' uses depre 67 pr_info_once("warning: `%s' uses deprecated v2 capabilities in a way that may be insecure\n",
68 get_task_comm(name, curre 68 get_task_comm(name, current));
69 } 69 }
70 70
71 /* 71 /*
72 * Version check. Return the number of u32s in 72 * Version check. Return the number of u32s in each capability flag
73 * array, or a negative value on error. 73 * array, or a negative value on error.
74 */ 74 */
75 static int cap_validate_magic(cap_user_header_ 75 static int cap_validate_magic(cap_user_header_t header, unsigned *tocopy)
76 { 76 {
77 __u32 version; 77 __u32 version;
78 78
79 if (get_user(version, &header->version 79 if (get_user(version, &header->version))
80 return -EFAULT; 80 return -EFAULT;
81 81
82 switch (version) { 82 switch (version) {
83 case _LINUX_CAPABILITY_VERSION_1: 83 case _LINUX_CAPABILITY_VERSION_1:
84 warn_legacy_capability_use(); 84 warn_legacy_capability_use();
85 *tocopy = _LINUX_CAPABILITY_U3 85 *tocopy = _LINUX_CAPABILITY_U32S_1;
86 break; 86 break;
87 case _LINUX_CAPABILITY_VERSION_2: 87 case _LINUX_CAPABILITY_VERSION_2:
88 warn_deprecated_v2(); 88 warn_deprecated_v2();
89 fallthrough; /* v3 is other 89 fallthrough; /* v3 is otherwise equivalent to v2 */
90 case _LINUX_CAPABILITY_VERSION_3: 90 case _LINUX_CAPABILITY_VERSION_3:
91 *tocopy = _LINUX_CAPABILITY_U3 91 *tocopy = _LINUX_CAPABILITY_U32S_3;
92 break; 92 break;
93 default: 93 default:
94 if (put_user((u32)_KERNEL_CAPA 94 if (put_user((u32)_KERNEL_CAPABILITY_VERSION, &header->version))
95 return -EFAULT; 95 return -EFAULT;
96 return -EINVAL; 96 return -EINVAL;
97 } 97 }
98 98
99 return 0; 99 return 0;
100 } 100 }
101 101
102 /* 102 /*
103 * The only thing that can change the capabili 103 * The only thing that can change the capabilities of the current
104 * process is the current process. As such, we 104 * process is the current process. As such, we can't be in this code
105 * at the same time as we are in the process o 105 * at the same time as we are in the process of setting capabilities
106 * in this process. The net result is that we 106 * in this process. The net result is that we can limit our use of
107 * locks to when we are reading the caps of an 107 * locks to when we are reading the caps of another process.
108 */ 108 */
109 static inline int cap_get_target_pid(pid_t pid 109 static inline int cap_get_target_pid(pid_t pid, kernel_cap_t *pEp,
110 kernel_ca 110 kernel_cap_t *pIp, kernel_cap_t *pPp)
111 { 111 {
112 int ret; 112 int ret;
113 113
114 if (pid && (pid != task_pid_vnr(curren 114 if (pid && (pid != task_pid_vnr(current))) {
115 const struct task_struct *targ 115 const struct task_struct *target;
116 116
117 rcu_read_lock(); 117 rcu_read_lock();
118 118
119 target = find_task_by_vpid(pid 119 target = find_task_by_vpid(pid);
120 if (!target) 120 if (!target)
121 ret = -ESRCH; 121 ret = -ESRCH;
122 else 122 else
123 ret = security_capget( 123 ret = security_capget(target, pEp, pIp, pPp);
124 124
125 rcu_read_unlock(); 125 rcu_read_unlock();
126 } else 126 } else
127 ret = security_capget(current, 127 ret = security_capget(current, pEp, pIp, pPp);
128 128
129 return ret; 129 return ret;
130 } 130 }
131 131
132 /** 132 /**
133 * sys_capget - get the capabilities of a give 133 * sys_capget - get the capabilities of a given process.
134 * @header: pointer to struct that contains ca 134 * @header: pointer to struct that contains capability version and
135 * target pid data 135 * target pid data
136 * @dataptr: pointer to struct that contains t 136 * @dataptr: pointer to struct that contains the effective, permitted,
137 * and inheritable capabilities that are 137 * and inheritable capabilities that are returned
138 * 138 *
139 * Returns 0 on success and < 0 on error. 139 * Returns 0 on success and < 0 on error.
140 */ 140 */
141 SYSCALL_DEFINE2(capget, cap_user_header_t, hea 141 SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)
142 { 142 {
143 int ret = 0; 143 int ret = 0;
144 pid_t pid; 144 pid_t pid;
145 unsigned tocopy; 145 unsigned tocopy;
146 kernel_cap_t pE, pI, pP; 146 kernel_cap_t pE, pI, pP;
147 struct __user_cap_data_struct kdata[2] 147 struct __user_cap_data_struct kdata[2];
148 148
149 ret = cap_validate_magic(header, &toco 149 ret = cap_validate_magic(header, &tocopy);
150 if ((dataptr == NULL) || (ret != 0)) 150 if ((dataptr == NULL) || (ret != 0))
151 return ((dataptr == NULL) && ( 151 return ((dataptr == NULL) && (ret == -EINVAL)) ? 0 : ret;
152 152
153 if (get_user(pid, &header->pid)) 153 if (get_user(pid, &header->pid))
154 return -EFAULT; 154 return -EFAULT;
155 155
156 if (pid < 0) 156 if (pid < 0)
157 return -EINVAL; 157 return -EINVAL;
158 158
159 ret = cap_get_target_pid(pid, &pE, &pI 159 ret = cap_get_target_pid(pid, &pE, &pI, &pP);
160 if (ret) 160 if (ret)
161 return ret; 161 return ret;
162 162
163 /* 163 /*
164 * Annoying legacy format with 64-bit 164 * Annoying legacy format with 64-bit capabilities exposed
165 * as two sets of 32-bit fields, so we 165 * as two sets of 32-bit fields, so we need to split the
166 * capability values up. 166 * capability values up.
167 */ 167 */
168 kdata[0].effective = pE.val; kdata[1 168 kdata[0].effective = pE.val; kdata[1].effective = pE.val >> 32;
169 kdata[0].permitted = pP.val; kdata[1 169 kdata[0].permitted = pP.val; kdata[1].permitted = pP.val >> 32;
170 kdata[0].inheritable = pI.val; kdata[1 170 kdata[0].inheritable = pI.val; kdata[1].inheritable = pI.val >> 32;
171 171
172 /* 172 /*
173 * Note, in the case, tocopy < _KERNEL 173 * Note, in the case, tocopy < _KERNEL_CAPABILITY_U32S,
174 * we silently drop the upper capabili 174 * we silently drop the upper capabilities here. This
175 * has the effect of making older libc 175 * has the effect of making older libcap
176 * implementations implicitly drop upp 176 * implementations implicitly drop upper capability
177 * bits when they perform a: capget/mo 177 * bits when they perform a: capget/modify/capset
178 * sequence. 178 * sequence.
179 * 179 *
180 * This behavior is considered fail-sa 180 * This behavior is considered fail-safe
181 * behavior. Upgrading the application 181 * behavior. Upgrading the application to a newer
182 * version of libcap will enable acces 182 * version of libcap will enable access to the newer
183 * capabilities. 183 * capabilities.
184 * 184 *
185 * An alternative would be to return a 185 * An alternative would be to return an error here
186 * (-ERANGE), but that causes legacy a 186 * (-ERANGE), but that causes legacy applications to
187 * unexpectedly fail; the capget/modif 187 * unexpectedly fail; the capget/modify/capset aborts
188 * before modification is attempted an 188 * before modification is attempted and the application
189 * fails. 189 * fails.
190 */ 190 */
191 if (copy_to_user(dataptr, kdata, tocop 191 if (copy_to_user(dataptr, kdata, tocopy * sizeof(kdata[0])))
192 return -EFAULT; 192 return -EFAULT;
193 193
194 return 0; 194 return 0;
195 } 195 }
196 196
197 static kernel_cap_t mk_kernel_cap(u32 low, u32 197 static kernel_cap_t mk_kernel_cap(u32 low, u32 high)
198 { 198 {
199 return (kernel_cap_t) { (low | ((u64)h 199 return (kernel_cap_t) { (low | ((u64)high << 32)) & CAP_VALID_MASK };
200 } 200 }
201 201
202 /** 202 /**
203 * sys_capset - set capabilities for a process 203 * sys_capset - set capabilities for a process or (*) a group of processes
204 * @header: pointer to struct that contains ca 204 * @header: pointer to struct that contains capability version and
205 * target pid data 205 * target pid data
206 * @data: pointer to struct that contains the 206 * @data: pointer to struct that contains the effective, permitted,
207 * and inheritable capabilities 207 * and inheritable capabilities
208 * 208 *
209 * Set capabilities for the current process on 209 * Set capabilities for the current process only. The ability to any other
210 * process(es) has been deprecated and removed 210 * process(es) has been deprecated and removed.
211 * 211 *
212 * The restrictions on setting capabilities ar 212 * The restrictions on setting capabilities are specified as:
213 * 213 *
214 * I: any raised capabilities must be a subset 214 * I: any raised capabilities must be a subset of the old permitted
215 * P: any raised capabilities must be a subset 215 * P: any raised capabilities must be a subset of the old permitted
216 * E: must be set to a subset of new permitted 216 * E: must be set to a subset of new permitted
217 * 217 *
218 * Returns 0 on success and < 0 on error. 218 * Returns 0 on success and < 0 on error.
219 */ 219 */
220 SYSCALL_DEFINE2(capset, cap_user_header_t, hea 220 SYSCALL_DEFINE2(capset, cap_user_header_t, header, const cap_user_data_t, data)
221 { 221 {
222 struct __user_cap_data_struct kdata[2] 222 struct __user_cap_data_struct kdata[2] = { { 0, }, };
223 unsigned tocopy, copybytes; 223 unsigned tocopy, copybytes;
224 kernel_cap_t inheritable, permitted, e 224 kernel_cap_t inheritable, permitted, effective;
225 struct cred *new; 225 struct cred *new;
226 int ret; 226 int ret;
227 pid_t pid; 227 pid_t pid;
228 228
229 ret = cap_validate_magic(header, &toco 229 ret = cap_validate_magic(header, &tocopy);
230 if (ret != 0) 230 if (ret != 0)
231 return ret; 231 return ret;
232 232
233 if (get_user(pid, &header->pid)) 233 if (get_user(pid, &header->pid))
234 return -EFAULT; 234 return -EFAULT;
235 235
236 /* may only affect current now */ 236 /* may only affect current now */
237 if (pid != 0 && pid != task_pid_vnr(cu 237 if (pid != 0 && pid != task_pid_vnr(current))
238 return -EPERM; 238 return -EPERM;
239 239
240 copybytes = tocopy * sizeof(struct __u 240 copybytes = tocopy * sizeof(struct __user_cap_data_struct);
241 if (copybytes > sizeof(kdata)) 241 if (copybytes > sizeof(kdata))
242 return -EFAULT; 242 return -EFAULT;
243 243
244 if (copy_from_user(&kdata, data, copyb 244 if (copy_from_user(&kdata, data, copybytes))
245 return -EFAULT; 245 return -EFAULT;
246 246
247 effective = mk_kernel_cap(kdata[0].e 247 effective = mk_kernel_cap(kdata[0].effective, kdata[1].effective);
248 permitted = mk_kernel_cap(kdata[0].p 248 permitted = mk_kernel_cap(kdata[0].permitted, kdata[1].permitted);
249 inheritable = mk_kernel_cap(kdata[0].i 249 inheritable = mk_kernel_cap(kdata[0].inheritable, kdata[1].inheritable);
250 250
251 new = prepare_creds(); 251 new = prepare_creds();
252 if (!new) 252 if (!new)
253 return -ENOMEM; 253 return -ENOMEM;
254 254
255 ret = security_capset(new, current_cre 255 ret = security_capset(new, current_cred(),
256 &effective, &inh 256 &effective, &inheritable, &permitted);
257 if (ret < 0) 257 if (ret < 0)
258 goto error; 258 goto error;
259 259
260 audit_log_capset(new, current_cred()); 260 audit_log_capset(new, current_cred());
261 261
262 return commit_creds(new); 262 return commit_creds(new);
263 263
264 error: 264 error:
265 abort_creds(new); 265 abort_creds(new);
266 return ret; 266 return ret;
267 } 267 }
268 268
269 /** 269 /**
270 * has_ns_capability - Does a task have a capa 270 * has_ns_capability - Does a task have a capability in a specific user ns
271 * @t: The task in question 271 * @t: The task in question
272 * @ns: target user namespace 272 * @ns: target user namespace
273 * @cap: The capability to be tested for 273 * @cap: The capability to be tested for
274 * 274 *
275 * Return true if the specified task has the g 275 * Return true if the specified task has the given superior capability
276 * currently in effect to the specified user n 276 * currently in effect to the specified user namespace, false if not.
277 * 277 *
278 * Note that this does not set PF_SUPERPRIV on 278 * Note that this does not set PF_SUPERPRIV on the task.
279 */ 279 */
280 bool has_ns_capability(struct task_struct *t, 280 bool has_ns_capability(struct task_struct *t,
281 struct user_namespace * 281 struct user_namespace *ns, int cap)
282 { 282 {
283 int ret; 283 int ret;
284 284
285 rcu_read_lock(); 285 rcu_read_lock();
286 ret = security_capable(__task_cred(t), 286 ret = security_capable(__task_cred(t), ns, cap, CAP_OPT_NONE);
287 rcu_read_unlock(); 287 rcu_read_unlock();
288 288
289 return (ret == 0); 289 return (ret == 0);
290 } 290 }
291 291
292 /** 292 /**
293 * has_capability - Does a task have a capabil 293 * has_capability - Does a task have a capability in init_user_ns
294 * @t: The task in question 294 * @t: The task in question
295 * @cap: The capability to be tested for 295 * @cap: The capability to be tested for
296 * 296 *
297 * Return true if the specified task has the g 297 * Return true if the specified task has the given superior capability
298 * currently in effect to the initial user nam 298 * currently in effect to the initial user namespace, false if not.
299 * 299 *
300 * Note that this does not set PF_SUPERPRIV on 300 * Note that this does not set PF_SUPERPRIV on the task.
301 */ 301 */
302 bool has_capability(struct task_struct *t, int 302 bool has_capability(struct task_struct *t, int cap)
303 { 303 {
304 return has_ns_capability(t, &init_user 304 return has_ns_capability(t, &init_user_ns, cap);
305 } 305 }
306 EXPORT_SYMBOL(has_capability); 306 EXPORT_SYMBOL(has_capability);
307 307
308 /** 308 /**
309 * has_ns_capability_noaudit - Does a task hav 309 * has_ns_capability_noaudit - Does a task have a capability (unaudited)
310 * in a specific user ns. 310 * in a specific user ns.
311 * @t: The task in question 311 * @t: The task in question
312 * @ns: target user namespace 312 * @ns: target user namespace
313 * @cap: The capability to be tested for 313 * @cap: The capability to be tested for
314 * 314 *
315 * Return true if the specified task has the g 315 * Return true if the specified task has the given superior capability
316 * currently in effect to the specified user n 316 * currently in effect to the specified user namespace, false if not.
317 * Do not write an audit message for the check 317 * Do not write an audit message for the check.
318 * 318 *
319 * Note that this does not set PF_SUPERPRIV on 319 * Note that this does not set PF_SUPERPRIV on the task.
320 */ 320 */
321 bool has_ns_capability_noaudit(struct task_str 321 bool has_ns_capability_noaudit(struct task_struct *t,
322 struct user_nam 322 struct user_namespace *ns, int cap)
323 { 323 {
324 int ret; 324 int ret;
325 325
326 rcu_read_lock(); 326 rcu_read_lock();
327 ret = security_capable(__task_cred(t), 327 ret = security_capable(__task_cred(t), ns, cap, CAP_OPT_NOAUDIT);
328 rcu_read_unlock(); 328 rcu_read_unlock();
329 329
330 return (ret == 0); 330 return (ret == 0);
331 } 331 }
332 332
333 /** 333 /**
334 * has_capability_noaudit - Does a task have a 334 * has_capability_noaudit - Does a task have a capability (unaudited) in the
335 * initial user ns 335 * initial user ns
336 * @t: The task in question 336 * @t: The task in question
337 * @cap: The capability to be tested for 337 * @cap: The capability to be tested for
338 * 338 *
339 * Return true if the specified task has the g 339 * Return true if the specified task has the given superior capability
340 * currently in effect to init_user_ns, false 340 * currently in effect to init_user_ns, false if not. Don't write an
341 * audit message for the check. 341 * audit message for the check.
342 * 342 *
343 * Note that this does not set PF_SUPERPRIV on 343 * Note that this does not set PF_SUPERPRIV on the task.
344 */ 344 */
345 bool has_capability_noaudit(struct task_struct 345 bool has_capability_noaudit(struct task_struct *t, int cap)
346 { 346 {
347 return has_ns_capability_noaudit(t, &i 347 return has_ns_capability_noaudit(t, &init_user_ns, cap);
348 } 348 }
349 EXPORT_SYMBOL(has_capability_noaudit); 349 EXPORT_SYMBOL(has_capability_noaudit);
350 350
351 static bool ns_capable_common(struct user_name 351 static bool ns_capable_common(struct user_namespace *ns,
352 int cap, 352 int cap,
353 unsigned int opt 353 unsigned int opts)
354 { 354 {
355 int capable; 355 int capable;
356 356
357 if (unlikely(!cap_valid(cap))) { 357 if (unlikely(!cap_valid(cap))) {
358 pr_crit("capable() called with 358 pr_crit("capable() called with invalid cap=%u\n", cap);
359 BUG(); 359 BUG();
360 } 360 }
361 361
362 capable = security_capable(current_cre 362 capable = security_capable(current_cred(), ns, cap, opts);
363 if (capable == 0) { 363 if (capable == 0) {
364 current->flags |= PF_SUPERPRIV 364 current->flags |= PF_SUPERPRIV;
365 return true; 365 return true;
366 } 366 }
367 return false; 367 return false;
368 } 368 }
369 369
370 /** 370 /**
371 * ns_capable - Determine if the current task 371 * ns_capable - Determine if the current task has a superior capability in effect
372 * @ns: The usernamespace we want the capabil 372 * @ns: The usernamespace we want the capability in
373 * @cap: The capability to be tested for 373 * @cap: The capability to be tested for
374 * 374 *
375 * Return true if the current task has the giv 375 * Return true if the current task has the given superior capability currently
376 * available for use, false if not. 376 * available for use, false if not.
377 * 377 *
378 * This sets PF_SUPERPRIV on the task if the c 378 * This sets PF_SUPERPRIV on the task if the capability is available on the
379 * assumption that it's about to be used. 379 * assumption that it's about to be used.
380 */ 380 */
381 bool ns_capable(struct user_namespace *ns, int 381 bool ns_capable(struct user_namespace *ns, int cap)
382 { 382 {
383 return ns_capable_common(ns, cap, CAP_ 383 return ns_capable_common(ns, cap, CAP_OPT_NONE);
384 } 384 }
385 EXPORT_SYMBOL(ns_capable); 385 EXPORT_SYMBOL(ns_capable);
386 386
387 /** 387 /**
388 * ns_capable_noaudit - Determine if the curre 388 * ns_capable_noaudit - Determine if the current task has a superior capability
389 * (unaudited) in effect 389 * (unaudited) in effect
390 * @ns: The usernamespace we want the capabil 390 * @ns: The usernamespace we want the capability in
391 * @cap: The capability to be tested for 391 * @cap: The capability to be tested for
392 * 392 *
393 * Return true if the current task has the giv 393 * Return true if the current task has the given superior capability currently
394 * available for use, false if not. 394 * available for use, false if not.
395 * 395 *
396 * This sets PF_SUPERPRIV on the task if the c 396 * This sets PF_SUPERPRIV on the task if the capability is available on the
397 * assumption that it's about to be used. 397 * assumption that it's about to be used.
398 */ 398 */
399 bool ns_capable_noaudit(struct user_namespace 399 bool ns_capable_noaudit(struct user_namespace *ns, int cap)
400 { 400 {
401 return ns_capable_common(ns, cap, CAP_ 401 return ns_capable_common(ns, cap, CAP_OPT_NOAUDIT);
402 } 402 }
403 EXPORT_SYMBOL(ns_capable_noaudit); 403 EXPORT_SYMBOL(ns_capable_noaudit);
404 404
405 /** 405 /**
406 * ns_capable_setid - Determine if the current 406 * ns_capable_setid - Determine if the current task has a superior capability
407 * in effect, while signalling that this check 407 * in effect, while signalling that this check is being done from within a
408 * setid or setgroups syscall. 408 * setid or setgroups syscall.
409 * @ns: The usernamespace we want the capabil 409 * @ns: The usernamespace we want the capability in
410 * @cap: The capability to be tested for 410 * @cap: The capability to be tested for
411 * 411 *
412 * Return true if the current task has the giv 412 * Return true if the current task has the given superior capability currently
413 * available for use, false if not. 413 * available for use, false if not.
414 * 414 *
415 * This sets PF_SUPERPRIV on the task if the c 415 * This sets PF_SUPERPRIV on the task if the capability is available on the
416 * assumption that it's about to be used. 416 * assumption that it's about to be used.
417 */ 417 */
418 bool ns_capable_setid(struct user_namespace *n 418 bool ns_capable_setid(struct user_namespace *ns, int cap)
419 { 419 {
420 return ns_capable_common(ns, cap, CAP_ 420 return ns_capable_common(ns, cap, CAP_OPT_INSETID);
421 } 421 }
422 EXPORT_SYMBOL(ns_capable_setid); 422 EXPORT_SYMBOL(ns_capable_setid);
423 423
424 /** 424 /**
425 * capable - Determine if the current task has 425 * capable - Determine if the current task has a superior capability in effect
426 * @cap: The capability to be tested for 426 * @cap: The capability to be tested for
427 * 427 *
428 * Return true if the current task has the giv 428 * Return true if the current task has the given superior capability currently
429 * available for use, false if not. 429 * available for use, false if not.
430 * 430 *
431 * This sets PF_SUPERPRIV on the task if the c 431 * This sets PF_SUPERPRIV on the task if the capability is available on the
432 * assumption that it's about to be used. 432 * assumption that it's about to be used.
433 */ 433 */
434 bool capable(int cap) 434 bool capable(int cap)
435 { 435 {
436 return ns_capable(&init_user_ns, cap); 436 return ns_capable(&init_user_ns, cap);
437 } 437 }
438 EXPORT_SYMBOL(capable); 438 EXPORT_SYMBOL(capable);
439 #endif /* CONFIG_MULTIUSER */ 439 #endif /* CONFIG_MULTIUSER */
440 440
441 /** 441 /**
442 * file_ns_capable - Determine if the file's o 442 * file_ns_capable - Determine if the file's opener had a capability in effect
443 * @file: The file we want to check 443 * @file: The file we want to check
444 * @ns: The usernamespace we want the capabil 444 * @ns: The usernamespace we want the capability in
445 * @cap: The capability to be tested for 445 * @cap: The capability to be tested for
446 * 446 *
447 * Return true if task that opened the file ha 447 * Return true if task that opened the file had a capability in effect
448 * when the file was opened. 448 * when the file was opened.
449 * 449 *
450 * This does not set PF_SUPERPRIV because the 450 * This does not set PF_SUPERPRIV because the caller may not
451 * actually be privileged. 451 * actually be privileged.
452 */ 452 */
453 bool file_ns_capable(const struct file *file, 453 bool file_ns_capable(const struct file *file, struct user_namespace *ns,
454 int cap) 454 int cap)
455 { 455 {
456 456
457 if (WARN_ON_ONCE(!cap_valid(cap))) 457 if (WARN_ON_ONCE(!cap_valid(cap)))
458 return false; 458 return false;
459 459
460 if (security_capable(file->f_cred, ns, 460 if (security_capable(file->f_cred, ns, cap, CAP_OPT_NONE) == 0)
461 return true; 461 return true;
462 462
463 return false; 463 return false;
464 } 464 }
465 EXPORT_SYMBOL(file_ns_capable); 465 EXPORT_SYMBOL(file_ns_capable);
466 466
467 /** 467 /**
468 * privileged_wrt_inode_uidgid - Do capabiliti 468 * privileged_wrt_inode_uidgid - Do capabilities in the namespace work over the inode?
469 * @ns: The user namespace in question 469 * @ns: The user namespace in question
470 * @idmap: idmap of the mount @inode was found 470 * @idmap: idmap of the mount @inode was found from
471 * @inode: The inode in question 471 * @inode: The inode in question
472 * 472 *
473 * Return true if the inode uid and gid are wi 473 * Return true if the inode uid and gid are within the namespace.
474 */ 474 */
475 bool privileged_wrt_inode_uidgid(struct user_n 475 bool privileged_wrt_inode_uidgid(struct user_namespace *ns,
476 struct mnt_id 476 struct mnt_idmap *idmap,
477 const struct 477 const struct inode *inode)
478 { 478 {
479 return vfsuid_has_mapping(ns, i_uid_in 479 return vfsuid_has_mapping(ns, i_uid_into_vfsuid(idmap, inode)) &&
480 vfsgid_has_mapping(ns, i_gid_in 480 vfsgid_has_mapping(ns, i_gid_into_vfsgid(idmap, inode));
481 } 481 }
482 482
483 /** 483 /**
484 * capable_wrt_inode_uidgid - Check nsown_capa 484 * capable_wrt_inode_uidgid - Check nsown_capable and uid and gid mapped
485 * @idmap: idmap of the mount @inode was found 485 * @idmap: idmap of the mount @inode was found from
486 * @inode: The inode in question 486 * @inode: The inode in question
487 * @cap: The capability in question 487 * @cap: The capability in question
488 * 488 *
489 * Return true if the current task has the giv 489 * Return true if the current task has the given capability targeted at
490 * its own user namespace and that the given i 490 * its own user namespace and that the given inode's uid and gid are
491 * mapped into the current user namespace. 491 * mapped into the current user namespace.
492 */ 492 */
493 bool capable_wrt_inode_uidgid(struct mnt_idmap 493 bool capable_wrt_inode_uidgid(struct mnt_idmap *idmap,
494 const struct ino 494 const struct inode *inode, int cap)
495 { 495 {
496 struct user_namespace *ns = current_us 496 struct user_namespace *ns = current_user_ns();
497 497
498 return ns_capable(ns, cap) && 498 return ns_capable(ns, cap) &&
499 privileged_wrt_inode_uidgid(ns, 499 privileged_wrt_inode_uidgid(ns, idmap, inode);
500 } 500 }
501 EXPORT_SYMBOL(capable_wrt_inode_uidgid); 501 EXPORT_SYMBOL(capable_wrt_inode_uidgid);
502 502
503 /** 503 /**
504 * ptracer_capable - Determine if the ptracer 504 * ptracer_capable - Determine if the ptracer holds CAP_SYS_PTRACE in the namespace
505 * @tsk: The task that may be ptraced 505 * @tsk: The task that may be ptraced
506 * @ns: The user namespace to search for CAP_S 506 * @ns: The user namespace to search for CAP_SYS_PTRACE in
507 * 507 *
508 * Return true if the task that is ptracing th 508 * Return true if the task that is ptracing the current task had CAP_SYS_PTRACE
509 * in the specified user namespace. 509 * in the specified user namespace.
510 */ 510 */
511 bool ptracer_capable(struct task_struct *tsk, 511 bool ptracer_capable(struct task_struct *tsk, struct user_namespace *ns)
512 { 512 {
513 int ret = 0; /* An absent tracer adds 513 int ret = 0; /* An absent tracer adds no restrictions */
514 const struct cred *cred; 514 const struct cred *cred;
515 515
516 rcu_read_lock(); 516 rcu_read_lock();
517 cred = rcu_dereference(tsk->ptracer_cr 517 cred = rcu_dereference(tsk->ptracer_cred);
518 if (cred) 518 if (cred)
519 ret = security_capable(cred, n 519 ret = security_capable(cred, ns, CAP_SYS_PTRACE,
520 CAP_OPT 520 CAP_OPT_NOAUDIT);
521 rcu_read_unlock(); 521 rcu_read_unlock();
522 return (ret == 0); 522 return (ret == 0);
523 } 523 }
524 524
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.