capabilities.cpp revision 24b29132a017f7fbfd009c3e6aec499d1b815dbf
124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// Copyright (C) 2016 The Android Open Source Project 224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// 324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// Licensed under the Apache License, Version 2.0 (the "License"); 424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// you may not use this file except in compliance with the License. 524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// You may obtain a copy of the License at 624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// 724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// http://www.apache.org/licenses/LICENSE-2.0 824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// 924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// Unless required by applicable law or agreed to in writing, software 1024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// distributed under the License is distributed on an "AS IS" BASIS, 1124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 1224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// See the License for the specific language governing permissions and 1324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes// limitations under the License. 1424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 1524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes#include "capabilities.h" 1624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 1724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes#include <sys/capability.h> 1824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes#include <sys/prctl.h> 1924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 2024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes#include <map> 2124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes#include <memory> 2224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 2324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes#include <android-base/logging.h> 2424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes#include <android-base/macros.h> 2524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 2624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes#define CAP_MAP_ENTRY(cap) { #cap, CAP_##cap } 2724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 2824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obesnamespace { 2924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obesconst std::map<std::string, int> cap_map = { 3024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(CHOWN), 3124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(DAC_OVERRIDE), 3224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(DAC_READ_SEARCH), 3324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(FOWNER), 3424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(FSETID), 3524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(KILL), 3624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SETGID), 3724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SETUID), 3824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SETPCAP), 3924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(LINUX_IMMUTABLE), 4024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(NET_BIND_SERVICE), 4124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(NET_BROADCAST), 4224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(NET_ADMIN), 4324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(NET_RAW), 4424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(IPC_LOCK), 4524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(IPC_OWNER), 4624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_MODULE), 4724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_RAWIO), 4824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_CHROOT), 4924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_PTRACE), 5024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_PACCT), 5124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_ADMIN), 5224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_BOOT), 5324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_NICE), 5424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_RESOURCE), 5524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_TIME), 5624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYS_TTY_CONFIG), 5724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(MKNOD), 5824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(LEASE), 5924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(AUDIT_WRITE), 6024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(AUDIT_CONTROL), 6124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SETFCAP), 6224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(MAC_OVERRIDE), 6324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(MAC_ADMIN), 6424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(SYSLOG), 6524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(WAKE_ALARM), 6624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(BLOCK_SUSPEND), 6724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes CAP_MAP_ENTRY(AUDIT_READ), 6824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes}; 6924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 7024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obesstatic_assert(CAP_LAST_CAP == CAP_AUDIT_READ, "CAP_LAST_CAP is not CAP_AUDIT_READ"); 7124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 7224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obesbool DropBoundingSet(const CapSet& to_keep) { 7324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes for (size_t cap = 0; cap < to_keep.size(); ++cap) { 7424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (to_keep.test(cap)) { 7524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes // No need to drop this capability. 7624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes continue; 7724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 7824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (cap_drop_bound(cap) == -1) { 7924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes PLOG(ERROR) << "cap_drop_bound(" << cap << ") failed"; 8024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return false; 8124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 8224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 8324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return true; 8424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes} 8524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 8624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obesbool SetProcCaps(const CapSet& to_keep, bool add_setpcap) { 8724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes cap_t caps = cap_init(); 8824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes auto deleter = [](cap_t* p) { cap_free(*p); }; 8924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes std::unique_ptr<cap_t, decltype(deleter)> ptr_caps(&caps, deleter); 9024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 9124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes cap_clear(caps); 9224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes cap_value_t value[1]; 9324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes for (size_t cap = 0; cap <= to_keep.size(); ++cap) { 9424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (to_keep.test(cap)) { 9524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes value[0] = cap; 9624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (cap_set_flag(caps, CAP_INHERITABLE, arraysize(value), value, CAP_SET) != 0 || 9724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes cap_set_flag(caps, CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0) { 9824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes PLOG(ERROR) << "cap_set_flag(INHERITABLE|PERMITTED, " << cap << ") failed"; 9924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return false; 10024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 10124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 10224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 10324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 10424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (add_setpcap) { 10524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes value[0] = CAP_SETPCAP; 10624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (cap_set_flag(caps, CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0 || 10724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes cap_set_flag(caps, CAP_EFFECTIVE, arraysize(value), value, CAP_SET) != 0) { 10824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes PLOG(ERROR) << "cap_set_flag(PERMITTED|EFFECTIVE, " << CAP_SETPCAP << ") failed"; 10924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return false; 11024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 11124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 11224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 11324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (cap_set_proc(caps) != 0) { 11424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes PLOG(ERROR) << "cap_set_proc(" << to_keep.to_ulong() << ") failed"; 11524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return false; 11624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 11724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return true; 11824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes} 11924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 12024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obesbool SetAmbientCaps(const CapSet& to_raise) { 12124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes for (size_t cap = 0; cap < to_raise.size(); ++cap) { 12224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (to_raise.test(cap)) { 12324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0) != 0) { 12424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes PLOG(ERROR) << "prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, " << cap << ") failed"; 12524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return false; 12624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 12724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 12824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 12924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return true; 13024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes} 13124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 13224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes} // namespace anonymous 13324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 13424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obesint LookupCap(const std::string& cap_name) { 13524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes auto e = cap_map.find(cap_name); 13624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (e != cap_map.end()) { 13724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return e->second; 13824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } else { 13924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return -1; 14024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 14124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes} 14224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 14324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obesbool SetCapsForExec(const CapSet& to_keep) { 14424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes // Need to keep SETPCAP to drop bounding set below. 14524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes bool add_setpcap = true; 14624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (!SetProcCaps(to_keep, add_setpcap)) { 14724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes LOG(ERROR) << "failed to apply initial capset"; 14824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return false; 14924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 15024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 15124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (!DropBoundingSet(to_keep)) { 15224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return false; 15324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 15424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 15524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes // If SETPCAP wasn't specifically requested, drop it now. 15624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes add_setpcap = false; 15724b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes if (!SetProcCaps(to_keep, add_setpcap)) { 15824b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes LOG(ERROR) << "failed to apply final capset"; 15924b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return false; 16024b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes } 16124b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes 16224b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes // Add the capabilities to the ambient set so that they are preserved across 16324b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes // execve(2). 16424b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes // See http://man7.org/linux/man-pages/man7/capabilities.7.html. 16524b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes return SetAmbientCaps(to_keep); 16624b29132a017f7fbfd009c3e6aec499d1b815dbfJorge Lucangeli Obes} 167