blob: 0e2cd2acc3e7c4adb35686452602db1277e23b3a [file] [log] [blame]
Jorge Lucangeli Obes24b29132016-10-27 10:33:03 -04001// Copyright (C) 2016 The Android Open Source Project
2//
3// Licensed under the Apache License, Version 2.0 (the "License");
4// you may not use this file except in compliance with the License.
5// You may obtain a copy of the License at
6//
7// http://www.apache.org/licenses/LICENSE-2.0
8//
9// Unless required by applicable law or agreed to in writing, software
10// distributed under the License is distributed on an "AS IS" BASIS,
11// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12// See the License for the specific language governing permissions and
13// limitations under the License.
14
15#include "capabilities.h"
16
Jorge Lucangeli Obes24b29132016-10-27 10:33:03 -040017#include <sys/prctl.h>
18
19#include <map>
20#include <memory>
21
22#include <android-base/logging.h>
23#include <android-base/macros.h>
24
25#define CAP_MAP_ENTRY(cap) { #cap, CAP_##cap }
26
Tom Cherry81f5d3e2017-06-22 12:53:17 -070027namespace android {
28namespace init {
29
Jorge Lucangeli Obesf3f824e2016-12-15 12:13:38 -050030static const std::map<std::string, int> cap_map = {
Christopher Ferrisab60ca52020-08-03 12:39:14 -070031 CAP_MAP_ENTRY(CHOWN),
32 CAP_MAP_ENTRY(DAC_OVERRIDE),
33 CAP_MAP_ENTRY(DAC_READ_SEARCH),
34 CAP_MAP_ENTRY(FOWNER),
35 CAP_MAP_ENTRY(FSETID),
36 CAP_MAP_ENTRY(KILL),
37 CAP_MAP_ENTRY(SETGID),
38 CAP_MAP_ENTRY(SETUID),
39 CAP_MAP_ENTRY(SETPCAP),
40 CAP_MAP_ENTRY(LINUX_IMMUTABLE),
41 CAP_MAP_ENTRY(NET_BIND_SERVICE),
42 CAP_MAP_ENTRY(NET_BROADCAST),
43 CAP_MAP_ENTRY(NET_ADMIN),
44 CAP_MAP_ENTRY(NET_RAW),
45 CAP_MAP_ENTRY(IPC_LOCK),
46 CAP_MAP_ENTRY(IPC_OWNER),
47 CAP_MAP_ENTRY(SYS_MODULE),
48 CAP_MAP_ENTRY(SYS_RAWIO),
49 CAP_MAP_ENTRY(SYS_CHROOT),
50 CAP_MAP_ENTRY(SYS_PTRACE),
51 CAP_MAP_ENTRY(SYS_PACCT),
52 CAP_MAP_ENTRY(SYS_ADMIN),
53 CAP_MAP_ENTRY(SYS_BOOT),
54 CAP_MAP_ENTRY(SYS_NICE),
55 CAP_MAP_ENTRY(SYS_RESOURCE),
56 CAP_MAP_ENTRY(SYS_TIME),
57 CAP_MAP_ENTRY(SYS_TTY_CONFIG),
58 CAP_MAP_ENTRY(MKNOD),
59 CAP_MAP_ENTRY(LEASE),
60 CAP_MAP_ENTRY(AUDIT_WRITE),
61 CAP_MAP_ENTRY(AUDIT_CONTROL),
62 CAP_MAP_ENTRY(SETFCAP),
63 CAP_MAP_ENTRY(MAC_OVERRIDE),
64 CAP_MAP_ENTRY(MAC_ADMIN),
65 CAP_MAP_ENTRY(SYSLOG),
66 CAP_MAP_ENTRY(WAKE_ALARM),
67 CAP_MAP_ENTRY(BLOCK_SUSPEND),
68 CAP_MAP_ENTRY(AUDIT_READ),
Christopher Ferrisab60ca52020-08-03 12:39:14 -070069 CAP_MAP_ENTRY(PERFMON),
70 CAP_MAP_ENTRY(BPF),
Christopher Ferris9bbb8412020-10-19 11:55:12 -070071 CAP_MAP_ENTRY(CHECKPOINT_RESTORE),
Jorge Lucangeli Obes24b29132016-10-27 10:33:03 -040072};
73
Christopher Ferris9bbb8412020-10-19 11:55:12 -070074static_assert(CAP_LAST_CAP == CAP_CHECKPOINT_RESTORE, "CAP_LAST_CAP is not CAP_CHECKPOINT_RESTORE");
Jorge Lucangeli Obes24b29132016-10-27 10:33:03 -040075
Jorge Lucangeli Obesf3f824e2016-12-15 12:13:38 -050076static bool ComputeCapAmbientSupported() {
Tom Cherryde6bd502018-02-13 16:50:08 -080077#if defined(__ANDROID__)
Jorge Lucangeli Obesf3f824e2016-12-15 12:13:38 -050078 return prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) >= 0;
Tom Cherryde6bd502018-02-13 16:50:08 -080079#else
80 return true;
81#endif
Jorge Lucangeli Obesf3f824e2016-12-15 12:13:38 -050082}
83
84static unsigned int ComputeLastValidCap() {
Tom Cherryde6bd502018-02-13 16:50:08 -080085#if defined(__ANDROID__)
Jorge Lucangeli Obesf3f824e2016-12-15 12:13:38 -050086 // Android does not support kernels < 3.8. 'CAP_WAKE_ALARM' has been present since 3.0, see
87 // http://lxr.free-electrons.com/source/include/linux/capability.h?v=3.0#L360.
88 unsigned int last_valid_cap = CAP_WAKE_ALARM;
89 for (; prctl(PR_CAPBSET_READ, last_valid_cap, 0, 0, 0) >= 0; ++last_valid_cap);
90
91 // |last_valid_cap| will be the first failing value.
92 return last_valid_cap - 1;
Tom Cherryde6bd502018-02-13 16:50:08 -080093#else
94 return CAP_LAST_CAP;
95#endif
Jorge Lucangeli Obesf3f824e2016-12-15 12:13:38 -050096}
97
98static bool DropBoundingSet(const CapSet& to_keep) {
99 unsigned int last_valid_cap = GetLastValidCap();
100 // When dropping the bounding set, attempt to drop capabilities reported at
101 // run-time, not at compile-time.
102 // If the run-time kernel is older than the compile-time headers, this
103 // avoids dropping an invalid capability. If the run-time kernel is newer
104 // than the headers, this guarantees all capabilities (even those unknown at
105 // compile time) will be dropped.
106 for (size_t cap = 0; cap <= last_valid_cap; ++cap) {
107 if (cap < to_keep.size() && to_keep.test(cap)) {
Jorge Lucangeli Obes24b29132016-10-27 10:33:03 -0400108 // No need to drop this capability.
109 continue;
110 }
111 if (cap_drop_bound(cap) == -1) {
112 PLOG(ERROR) << "cap_drop_bound(" << cap << ") failed";
113 return false;
114 }
115 }
116 return true;
117}
118
Jorge Lucangeli Obesf3f824e2016-12-15 12:13:38 -0500119static bool SetProcCaps(const CapSet& to_keep, bool add_setpcap) {
Luis Hector Chavez7bb36022017-06-29 09:47:51 -0700120 ScopedCaps caps(cap_init());
Jorge Lucangeli Obes24b29132016-10-27 10:33:03 -0400121
Luis Hector Chavez7bb36022017-06-29 09:47:51 -0700122 cap_clear(caps.get());
Jorge Lucangeli Obes24b29132016-10-27 10:33:03 -0400123 cap_value_t value[1];
Jorge Lucangeli Obesf3f824e2016-12-15 12:13:38 -0500124 for (size_t cap = 0; cap < to_keep.size(); ++cap) {
Jorge Lucangeli Obes24b29132016-10-27 10:33:03 -0400125 if (to_keep.test(cap)) {
126 value[0] = cap;
Luis Hector Chavez7bb36022017-06-29 09:47:51 -0700127 if (cap_set_flag(caps.get(), CAP_INHERITABLE, arraysize(value), value, CAP_SET) != 0 ||
128 cap_set_flag(caps.get(), CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0) {
Jorge Lucangeli Obes24b29132016-10-27 10:33:03 -0400129 PLOG(ERROR) << "cap_set_flag(INHERITABLE|PERMITTED, " << cap << ") failed";
130 return false;
131 }
132 }
133 }
134
135 if (add_setpcap) {
136 value[0] = CAP_SETPCAP;
Luis Hector Chavez7bb36022017-06-29 09:47:51 -0700137 if (cap_set_flag(caps.get(), CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0 ||
138 cap_set_flag(caps.get(), CAP_EFFECTIVE, arraysize(value), value, CAP_SET) != 0) {
Jorge Lucangeli Obes24b29132016-10-27 10:33:03 -0400139 PLOG(ERROR) << "cap_set_flag(PERMITTED|EFFECTIVE, " << CAP_SETPCAP << ") failed";
140 return false;
141 }
142 }
143
Luis Hector Chavez7bb36022017-06-29 09:47:51 -0700144 if (cap_set_proc(caps.get()) != 0) {
Jorge Lucangeli Obes24b29132016-10-27 10:33:03 -0400145 PLOG(ERROR) << "cap_set_proc(" << to_keep.to_ulong() << ") failed";
146 return false;
147 }
148 return true;
149}
150
Jorge Lucangeli Obesf3f824e2016-12-15 12:13:38 -0500151static bool SetAmbientCaps(const CapSet& to_raise) {
Tom Cherryde6bd502018-02-13 16:50:08 -0800152#if defined(__ANDROID__)
Jorge Lucangeli Obes24b29132016-10-27 10:33:03 -0400153 for (size_t cap = 0; cap < to_raise.size(); ++cap) {
154 if (to_raise.test(cap)) {
155 if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0) != 0) {
156 PLOG(ERROR) << "prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, " << cap << ") failed";
157 return false;
158 }
159 }
160 }
Tom Cherryde6bd502018-02-13 16:50:08 -0800161#endif
Jorge Lucangeli Obes24b29132016-10-27 10:33:03 -0400162 return true;
163}
164
Jorge Lucangeli Obes24b29132016-10-27 10:33:03 -0400165int LookupCap(const std::string& cap_name) {
166 auto e = cap_map.find(cap_name);
167 if (e != cap_map.end()) {
168 return e->second;
169 } else {
170 return -1;
171 }
172}
173
Jorge Lucangeli Obesf3f824e2016-12-15 12:13:38 -0500174bool CapAmbientSupported() {
175 static bool cap_ambient_supported = ComputeCapAmbientSupported();
176 return cap_ambient_supported;
177}
178
179unsigned int GetLastValidCap() {
180 static unsigned int last_valid_cap = ComputeLastValidCap();
181 return last_valid_cap;
182}
183
Jorge Lucangeli Obes24b29132016-10-27 10:33:03 -0400184bool SetCapsForExec(const CapSet& to_keep) {
185 // Need to keep SETPCAP to drop bounding set below.
186 bool add_setpcap = true;
187 if (!SetProcCaps(to_keep, add_setpcap)) {
188 LOG(ERROR) << "failed to apply initial capset";
189 return false;
190 }
191
192 if (!DropBoundingSet(to_keep)) {
193 return false;
194 }
195
196 // If SETPCAP wasn't specifically requested, drop it now.
197 add_setpcap = false;
198 if (!SetProcCaps(to_keep, add_setpcap)) {
199 LOG(ERROR) << "failed to apply final capset";
200 return false;
201 }
202
203 // Add the capabilities to the ambient set so that they are preserved across
204 // execve(2).
205 // See http://man7.org/linux/man-pages/man7/capabilities.7.html.
206 return SetAmbientCaps(to_keep);
207}
Tom Cherry81f5d3e2017-06-22 12:53:17 -0700208
Luis Hector Chavez94fb5b02017-11-16 15:52:00 -0800209bool DropInheritableCaps() {
210 ScopedCaps caps(cap_get_proc());
211 if (cap_clear_flag(caps.get(), CAP_INHERITABLE) == -1) {
212 PLOG(ERROR) << "cap_clear_flag(INHERITABLE) failed";
213 return false;
214 }
215 if (cap_set_proc(caps.get()) != 0) {
216 PLOG(ERROR) << "cap_set_proc() failed";
217 return false;
218 }
219 return true;
220}
221
Tom Cherry81f5d3e2017-06-22 12:53:17 -0700222} // namespace init
223} // namespace android