124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// Copyright (C) 2016 The Android Open Source Project 224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// 324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// Licensed under the Apache License, Version 2.0 (the "License"); 424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// you may not use this file except in compliance with the License. 524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// You may obtain a copy of the License at 624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// 724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// http://www.apache.org/licenses/LICENSE-2.0 824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// 924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// Unless required by applicable law or agreed to in writing, software 1024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// distributed under the License is distributed on an "AS IS" BASIS, 1124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 1224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// See the License for the specific language governing permissions and 1324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// limitations under the License. 1424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 1524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes#include "capabilities.h" 1624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 1724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes#include <sys/prctl.h> 1824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 1924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes#include <map> 2024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes#include <memory> 2124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 2224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes#include <android-base/logging.h> 2324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes#include <android-base/macros.h> 2424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 2524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes#define CAP_MAP_ENTRY(cap) { #cap, CAP_##cap } 2624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 2781f5d3ebef2c3789737bf718fc2a2cdd7b9e8b33Tom Cherrynamespace android { 2881f5d3ebef2c3789737bf718fc2a2cdd7b9e8b33Tom Cherrynamespace init { 2981f5d3ebef2c3789737bf718fc2a2cdd7b9e8b33Tom Cherry 30f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obesstatic const std::map<std::string, int> cap_map = { 3124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(CHOWN), 3224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(DAC_OVERRIDE), 3324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(DAC_READ_SEARCH), 3424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(FOWNER), 3524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(FSETID), 3624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(KILL), 3724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SETGID), 3824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SETUID), 3924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SETPCAP), 4024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(LINUX_IMMUTABLE), 4124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(NET_BIND_SERVICE), 4224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(NET_BROADCAST), 4324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(NET_ADMIN), 4424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(NET_RAW), 4524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(IPC_LOCK), 4624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(IPC_OWNER), 4724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_MODULE), 4824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_RAWIO), 4924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_CHROOT), 5024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_PTRACE), 5124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_PACCT), 5224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_ADMIN), 5324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_BOOT), 5424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_NICE), 5524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_RESOURCE), 5624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_TIME), 5724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_TTY_CONFIG), 5824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(MKNOD), 5924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(LEASE), 6024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(AUDIT_WRITE), 6124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(AUDIT_CONTROL), 6224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SETFCAP), 6324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(MAC_OVERRIDE), 6424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(MAC_ADMIN), 6524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYSLOG), 6624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(WAKE_ALARM), 6724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(BLOCK_SUSPEND), 6824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(AUDIT_READ), 6924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes}; 7024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 7124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obesstatic_assert(CAP_LAST_CAP == CAP_AUDIT_READ, "CAP_LAST_CAP is not CAP_AUDIT_READ"); 7224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 73f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obesstatic bool ComputeCapAmbientSupported() { 74de6bd50d4238d19ec401127bcf2321dc679d908dTom Cherry#if defined(__ANDROID__) 75f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes return prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) >= 0; 76de6bd50d4238d19ec401127bcf2321dc679d908dTom Cherry#else 77de6bd50d4238d19ec401127bcf2321dc679d908dTom Cherry return true; 78de6bd50d4238d19ec401127bcf2321dc679d908dTom Cherry#endif 79f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes} 80f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes 81f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obesstatic unsigned int ComputeLastValidCap() { 82de6bd50d4238d19ec401127bcf2321dc679d908dTom Cherry#if defined(__ANDROID__) 83f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes // Android does not support kernels < 3.8. 'CAP_WAKE_ALARM' has been present since 3.0, see 84f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes // http://lxr.free-electrons.com/source/include/linux/capability.h?v=3.0#L360. 85f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes unsigned int last_valid_cap = CAP_WAKE_ALARM; 86f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes for (; prctl(PR_CAPBSET_READ, last_valid_cap, 0, 0, 0) >= 0; ++last_valid_cap); 87f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes 88f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes // |last_valid_cap| will be the first failing value. 89f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes return last_valid_cap - 1; 90de6bd50d4238d19ec401127bcf2321dc679d908dTom Cherry#else 91de6bd50d4238d19ec401127bcf2321dc679d908dTom Cherry return CAP_LAST_CAP; 92de6bd50d4238d19ec401127bcf2321dc679d908dTom Cherry#endif 93f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes} 94f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes 95f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obesstatic bool DropBoundingSet(const CapSet& to_keep) { 96f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes unsigned int last_valid_cap = GetLastValidCap(); 97f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes // When dropping the bounding set, attempt to drop capabilities reported at 98f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes // run-time, not at compile-time. 99f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes // If the run-time kernel is older than the compile-time headers, this 100f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes // avoids dropping an invalid capability. If the run-time kernel is newer 101f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes // than the headers, this guarantees all capabilities (even those unknown at 102f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes // compile time) will be dropped. 103f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes for (size_t cap = 0; cap <= last_valid_cap; ++cap) { 104f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes if (cap < to_keep.size() && to_keep.test(cap)) { 10524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes // No need to drop this capability. 10624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes continue; 10724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 10824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (cap_drop_bound(cap) == -1) { 10924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes PLOG(ERROR) << "cap_drop_bound(" << cap << ") failed"; 11024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return false; 11124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 11224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 11324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return true; 11424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes} 11524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 116f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obesstatic bool SetProcCaps(const CapSet& to_keep, bool add_setpcap) { 1177bb360230d01f2eb2194cd362874ef199517a064Luis Hector Chavez ScopedCaps caps(cap_init()); 11824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 1197bb360230d01f2eb2194cd362874ef199517a064Luis Hector Chavez cap_clear(caps.get()); 12024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes cap_value_t value[1]; 121f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes for (size_t cap = 0; cap < to_keep.size(); ++cap) { 12224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (to_keep.test(cap)) { 12324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes value[0] = cap; 1247bb360230d01f2eb2194cd362874ef199517a064Luis Hector Chavez if (cap_set_flag(caps.get(), CAP_INHERITABLE, arraysize(value), value, CAP_SET) != 0 || 1257bb360230d01f2eb2194cd362874ef199517a064Luis Hector Chavez cap_set_flag(caps.get(), CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0) { 12624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes PLOG(ERROR) << "cap_set_flag(INHERITABLE|PERMITTED, " << cap << ") failed"; 12724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return false; 12824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 12924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 13024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 13124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 13224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (add_setpcap) { 13324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes value[0] = CAP_SETPCAP; 1347bb360230d01f2eb2194cd362874ef199517a064Luis Hector Chavez if (cap_set_flag(caps.get(), CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0 || 1357bb360230d01f2eb2194cd362874ef199517a064Luis Hector Chavez cap_set_flag(caps.get(), CAP_EFFECTIVE, arraysize(value), value, CAP_SET) != 0) { 13624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes PLOG(ERROR) << "cap_set_flag(PERMITTED|EFFECTIVE, " << CAP_SETPCAP << ") failed"; 13724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return false; 13824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 13924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 14024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 1417bb360230d01f2eb2194cd362874ef199517a064Luis Hector Chavez if (cap_set_proc(caps.get()) != 0) { 14224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes PLOG(ERROR) << "cap_set_proc(" << to_keep.to_ulong() << ") failed"; 14324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return false; 14424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 14524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return true; 14624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes} 14724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 148f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obesstatic bool SetAmbientCaps(const CapSet& to_raise) { 149de6bd50d4238d19ec401127bcf2321dc679d908dTom Cherry#if defined(__ANDROID__) 15024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes for (size_t cap = 0; cap < to_raise.size(); ++cap) { 15124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (to_raise.test(cap)) { 15224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0) != 0) { 15324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes PLOG(ERROR) << "prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, " << cap << ") failed"; 15424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return false; 15524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 15624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 15724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 158de6bd50d4238d19ec401127bcf2321dc679d908dTom Cherry#endif 15924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return true; 16024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes} 16124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 16224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obesint LookupCap(const std::string& cap_name) { 16324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes auto e = cap_map.find(cap_name); 16424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (e != cap_map.end()) { 16524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return e->second; 16624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } else { 16724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return -1; 16824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 16924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes} 17024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 171f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obesbool CapAmbientSupported() { 172f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes static bool cap_ambient_supported = ComputeCapAmbientSupported(); 173f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes return cap_ambient_supported; 174f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes} 175f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes 176f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obesunsigned int GetLastValidCap() { 177f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes static unsigned int last_valid_cap = ComputeLastValidCap(); 178f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes return last_valid_cap; 179f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes} 180f3f824ee42892fb69cb0d9b0557cd9c5aed357d2Jorge Lucangeli Obes 18124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obesbool SetCapsForExec(const CapSet& to_keep) { 18224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes // Need to keep SETPCAP to drop bounding set below. 18324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes bool add_setpcap = true; 18424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (!SetProcCaps(to_keep, add_setpcap)) { 18524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes LOG(ERROR) << "failed to apply initial capset"; 18624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return false; 18724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 18824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 18924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (!DropBoundingSet(to_keep)) { 19024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return false; 19124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 19224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 19324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes // If SETPCAP wasn't specifically requested, drop it now. 19424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes add_setpcap = false; 19524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (!SetProcCaps(to_keep, add_setpcap)) { 19624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes LOG(ERROR) << "failed to apply final capset"; 19724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return false; 19824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 19924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 20024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes // Add the capabilities to the ambient set so that they are preserved across 20124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes // execve(2). 20224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes // See http://man7.org/linux/man-pages/man7/capabilities.7.html. 20324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return SetAmbientCaps(to_keep); 20424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes} 20581f5d3ebef2c3789737bf718fc2a2cdd7b9e8b33Tom Cherry 20694fb5b0bef4ff7bd5c610ed5ebfad9c0ba41c62fLuis Hector Chavezbool DropInheritableCaps() { 20794fb5b0bef4ff7bd5c610ed5ebfad9c0ba41c62fLuis Hector Chavez ScopedCaps caps(cap_get_proc()); 20894fb5b0bef4ff7bd5c610ed5ebfad9c0ba41c62fLuis Hector Chavez if (cap_clear_flag(caps.get(), CAP_INHERITABLE) == -1) { 20994fb5b0bef4ff7bd5c610ed5ebfad9c0ba41c62fLuis Hector Chavez PLOG(ERROR) << "cap_clear_flag(INHERITABLE) failed"; 21094fb5b0bef4ff7bd5c610ed5ebfad9c0ba41c62fLuis Hector Chavez return false; 21194fb5b0bef4ff7bd5c610ed5ebfad9c0ba41c62fLuis Hector Chavez } 21294fb5b0bef4ff7bd5c610ed5ebfad9c0ba41c62fLuis Hector Chavez if (cap_set_proc(caps.get()) != 0) { 21394fb5b0bef4ff7bd5c610ed5ebfad9c0ba41c62fLuis Hector Chavez PLOG(ERROR) << "cap_set_proc() failed"; 21494fb5b0bef4ff7bd5c610ed5ebfad9c0ba41c62fLuis Hector Chavez return false; 21594fb5b0bef4ff7bd5c610ed5ebfad9c0ba41c62fLuis Hector Chavez } 21694fb5b0bef4ff7bd5c610ed5ebfad9c0ba41c62fLuis Hector Chavez return true; 21794fb5b0bef4ff7bd5c610ed5ebfad9c0ba41c62fLuis Hector Chavez} 21894fb5b0bef4ff7bd5c610ed5ebfad9c0ba41c62fLuis Hector Chavez 21981f5d3ebef2c3789737bf718fc2a2cdd7b9e8b33Tom Cherry} // namespace init 22081f5d3ebef2c3789737bf718fc2a2cdd7b9e8b33Tom Cherry} // namespace android 221