capabilities.cpp revision 7bb360230d01f2eb2194cd362874ef199517a064 
1// Copyright (C) 2016 The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7//      http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15#include "capabilities.h"
16
17#include <sys/capability.h>
18#include <sys/prctl.h>
19
20#include <map>
21#include <memory>
22
23#include <android-base/logging.h>
24#include <android-base/macros.h>
25
26#define CAP_MAP_ENTRY(cap) { #cap, CAP_##cap }
27
28namespace android {
29namespace init {
30
31static const std::map<std::string, int> cap_map = {
32    CAP_MAP_ENTRY(CHOWN),
33    CAP_MAP_ENTRY(DAC_OVERRIDE),
34    CAP_MAP_ENTRY(DAC_READ_SEARCH),
35    CAP_MAP_ENTRY(FOWNER),
36    CAP_MAP_ENTRY(FSETID),
37    CAP_MAP_ENTRY(KILL),
38    CAP_MAP_ENTRY(SETGID),
39    CAP_MAP_ENTRY(SETUID),
40    CAP_MAP_ENTRY(SETPCAP),
41    CAP_MAP_ENTRY(LINUX_IMMUTABLE),
42    CAP_MAP_ENTRY(NET_BIND_SERVICE),
43    CAP_MAP_ENTRY(NET_BROADCAST),
44    CAP_MAP_ENTRY(NET_ADMIN),
45    CAP_MAP_ENTRY(NET_RAW),
46    CAP_MAP_ENTRY(IPC_LOCK),
47    CAP_MAP_ENTRY(IPC_OWNER),
48    CAP_MAP_ENTRY(SYS_MODULE),
49    CAP_MAP_ENTRY(SYS_RAWIO),
50    CAP_MAP_ENTRY(SYS_CHROOT),
51    CAP_MAP_ENTRY(SYS_PTRACE),
52    CAP_MAP_ENTRY(SYS_PACCT),
53    CAP_MAP_ENTRY(SYS_ADMIN),
54    CAP_MAP_ENTRY(SYS_BOOT),
55    CAP_MAP_ENTRY(SYS_NICE),
56    CAP_MAP_ENTRY(SYS_RESOURCE),
57    CAP_MAP_ENTRY(SYS_TIME),
58    CAP_MAP_ENTRY(SYS_TTY_CONFIG),
59    CAP_MAP_ENTRY(MKNOD),
60    CAP_MAP_ENTRY(LEASE),
61    CAP_MAP_ENTRY(AUDIT_WRITE),
62    CAP_MAP_ENTRY(AUDIT_CONTROL),
63    CAP_MAP_ENTRY(SETFCAP),
64    CAP_MAP_ENTRY(MAC_OVERRIDE),
65    CAP_MAP_ENTRY(MAC_ADMIN),
66    CAP_MAP_ENTRY(SYSLOG),
67    CAP_MAP_ENTRY(WAKE_ALARM),
68    CAP_MAP_ENTRY(BLOCK_SUSPEND),
69    CAP_MAP_ENTRY(AUDIT_READ),
70};
71
72static_assert(CAP_LAST_CAP == CAP_AUDIT_READ, "CAP_LAST_CAP is not CAP_AUDIT_READ");
73
74static bool ComputeCapAmbientSupported() {
75    return prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) >= 0;
76}
77
78static unsigned int ComputeLastValidCap() {
79    // Android does not support kernels < 3.8. 'CAP_WAKE_ALARM' has been present since 3.0, see
80    // http://lxr.free-electrons.com/source/include/linux/capability.h?v=3.0#L360.
81    unsigned int last_valid_cap = CAP_WAKE_ALARM;
82    for (; prctl(PR_CAPBSET_READ, last_valid_cap, 0, 0, 0) >= 0; ++last_valid_cap);
83
84    // |last_valid_cap| will be the first failing value.
85    return last_valid_cap - 1;
86}
87
88static bool DropBoundingSet(const CapSet& to_keep) {
89    unsigned int last_valid_cap = GetLastValidCap();
90    // When dropping the bounding set, attempt to drop capabilities reported at
91    // run-time, not at compile-time.
92    // If the run-time kernel is older than the compile-time headers, this
93    // avoids dropping an invalid capability. If the run-time kernel is newer
94    // than the headers, this guarantees all capabilities (even those unknown at
95    // compile time) will be dropped.
96    for (size_t cap = 0; cap <= last_valid_cap; ++cap) {
97        if (cap < to_keep.size() && to_keep.test(cap)) {
98            // No need to drop this capability.
99            continue;
100        }
101        if (cap_drop_bound(cap) == -1) {
102            PLOG(ERROR) << "cap_drop_bound(" << cap << ") failed";
103            return false;
104        }
105    }
106    return true;
107}
108
109static bool SetProcCaps(const CapSet& to_keep, bool add_setpcap) {
110    ScopedCaps caps(cap_init());
111
112    cap_clear(caps.get());
113    cap_value_t value[1];
114    for (size_t cap = 0; cap < to_keep.size(); ++cap) {
115        if (to_keep.test(cap)) {
116            value[0] = cap;
117            if (cap_set_flag(caps.get(), CAP_INHERITABLE, arraysize(value), value, CAP_SET) != 0 ||
118                cap_set_flag(caps.get(), CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0) {
119                PLOG(ERROR) << "cap_set_flag(INHERITABLE|PERMITTED, " << cap << ") failed";
120                return false;
121            }
122        }
123    }
124
125    if (add_setpcap) {
126        value[0] = CAP_SETPCAP;
127        if (cap_set_flag(caps.get(), CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0 ||
128            cap_set_flag(caps.get(), CAP_EFFECTIVE, arraysize(value), value, CAP_SET) != 0) {
129            PLOG(ERROR) << "cap_set_flag(PERMITTED|EFFECTIVE, " << CAP_SETPCAP << ") failed";
130            return false;
131        }
132    }
133
134    if (cap_set_proc(caps.get()) != 0) {
135        PLOG(ERROR) << "cap_set_proc(" << to_keep.to_ulong() << ") failed";
136        return false;
137    }
138    return true;
139}
140
141static bool SetAmbientCaps(const CapSet& to_raise) {
142    for (size_t cap = 0; cap < to_raise.size(); ++cap) {
143        if (to_raise.test(cap)) {
144            if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0) != 0) {
145                PLOG(ERROR) << "prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, " << cap << ") failed";
146                return false;
147            }
148        }
149    }
150    return true;
151}
152
153int LookupCap(const std::string& cap_name) {
154    auto e = cap_map.find(cap_name);
155    if (e != cap_map.end()) {
156        return e->second;
157    } else {
158        return -1;
159    }
160}
161
162bool CapAmbientSupported() {
163    static bool cap_ambient_supported = ComputeCapAmbientSupported();
164    return cap_ambient_supported;
165}
166
167unsigned int GetLastValidCap() {
168    static unsigned int last_valid_cap = ComputeLastValidCap();
169    return last_valid_cap;
170}
171
172bool SetCapsForExec(const CapSet& to_keep) {
173    // Need to keep SETPCAP to drop bounding set below.
174    bool add_setpcap = true;
175    if (!SetProcCaps(to_keep, add_setpcap)) {
176        LOG(ERROR) << "failed to apply initial capset";
177        return false;
178    }
179
180    if (!DropBoundingSet(to_keep)) {
181        return false;
182    }
183
184    // If SETPCAP wasn't specifically requested, drop it now.
185    add_setpcap = false;
186    if (!SetProcCaps(to_keep, add_setpcap)) {
187        LOG(ERROR) << "failed to apply final capset";
188        return false;
189    }
190
191    // Add the capabilities to the ambient set so that they are preserved across
192    // execve(2).
193    // See http://man7.org/linux/man-pages/man7/capabilities.7.html.
194    return SetAmbientCaps(to_keep);
195}
196
197}  // namespace init
198}  // namespace android
199