Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 1 | // Copyright (C) 2016 The Android Open Source Project |
| 2 | // |
| 3 | // Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | // you may not use this file except in compliance with the License. |
| 5 | // You may obtain a copy of the License at |
| 6 | // |
| 7 | // http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | // |
| 9 | // Unless required by applicable law or agreed to in writing, software |
| 10 | // distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | // See the License for the specific language governing permissions and |
| 13 | // limitations under the License. |
| 14 | |
| 15 | #include "capabilities.h" |
| 16 | |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 17 | #include <sys/prctl.h> |
| 18 | |
| 19 | #include <map> |
| 20 | #include <memory> |
| 21 | |
| 22 | #include <android-base/logging.h> |
| 23 | #include <android-base/macros.h> |
| 24 | |
| 25 | #define CAP_MAP_ENTRY(cap) { #cap, CAP_##cap } |
| 26 | |
Tom Cherry | 81f5d3e | 2017-06-22 12:53:17 -0700 | [diff] [blame] | 27 | namespace android { |
| 28 | namespace init { |
| 29 | |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 30 | static const std::map<std::string, int> cap_map = { |
Christopher Ferris | ab60ca5 | 2020-08-03 12:39:14 -0700 | [diff] [blame] | 31 | CAP_MAP_ENTRY(CHOWN), |
| 32 | CAP_MAP_ENTRY(DAC_OVERRIDE), |
| 33 | CAP_MAP_ENTRY(DAC_READ_SEARCH), |
| 34 | CAP_MAP_ENTRY(FOWNER), |
| 35 | CAP_MAP_ENTRY(FSETID), |
| 36 | CAP_MAP_ENTRY(KILL), |
| 37 | CAP_MAP_ENTRY(SETGID), |
| 38 | CAP_MAP_ENTRY(SETUID), |
| 39 | CAP_MAP_ENTRY(SETPCAP), |
| 40 | CAP_MAP_ENTRY(LINUX_IMMUTABLE), |
| 41 | CAP_MAP_ENTRY(NET_BIND_SERVICE), |
| 42 | CAP_MAP_ENTRY(NET_BROADCAST), |
| 43 | CAP_MAP_ENTRY(NET_ADMIN), |
| 44 | CAP_MAP_ENTRY(NET_RAW), |
| 45 | CAP_MAP_ENTRY(IPC_LOCK), |
| 46 | CAP_MAP_ENTRY(IPC_OWNER), |
| 47 | CAP_MAP_ENTRY(SYS_MODULE), |
| 48 | CAP_MAP_ENTRY(SYS_RAWIO), |
| 49 | CAP_MAP_ENTRY(SYS_CHROOT), |
| 50 | CAP_MAP_ENTRY(SYS_PTRACE), |
| 51 | CAP_MAP_ENTRY(SYS_PACCT), |
| 52 | CAP_MAP_ENTRY(SYS_ADMIN), |
| 53 | CAP_MAP_ENTRY(SYS_BOOT), |
| 54 | CAP_MAP_ENTRY(SYS_NICE), |
| 55 | CAP_MAP_ENTRY(SYS_RESOURCE), |
| 56 | CAP_MAP_ENTRY(SYS_TIME), |
| 57 | CAP_MAP_ENTRY(SYS_TTY_CONFIG), |
| 58 | CAP_MAP_ENTRY(MKNOD), |
| 59 | CAP_MAP_ENTRY(LEASE), |
| 60 | CAP_MAP_ENTRY(AUDIT_WRITE), |
| 61 | CAP_MAP_ENTRY(AUDIT_CONTROL), |
| 62 | CAP_MAP_ENTRY(SETFCAP), |
| 63 | CAP_MAP_ENTRY(MAC_OVERRIDE), |
| 64 | CAP_MAP_ENTRY(MAC_ADMIN), |
| 65 | CAP_MAP_ENTRY(SYSLOG), |
| 66 | CAP_MAP_ENTRY(WAKE_ALARM), |
| 67 | CAP_MAP_ENTRY(BLOCK_SUSPEND), |
| 68 | CAP_MAP_ENTRY(AUDIT_READ), |
Christopher Ferris | ab60ca5 | 2020-08-03 12:39:14 -0700 | [diff] [blame] | 69 | CAP_MAP_ENTRY(PERFMON), |
| 70 | CAP_MAP_ENTRY(BPF), |
Christopher Ferris | 9bbb841 | 2020-10-19 11:55:12 -0700 | [diff] [blame] | 71 | CAP_MAP_ENTRY(CHECKPOINT_RESTORE), |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 72 | }; |
| 73 | |
Christopher Ferris | 9bbb841 | 2020-10-19 11:55:12 -0700 | [diff] [blame] | 74 | static_assert(CAP_LAST_CAP == CAP_CHECKPOINT_RESTORE, "CAP_LAST_CAP is not CAP_CHECKPOINT_RESTORE"); |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 75 | |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 76 | static bool ComputeCapAmbientSupported() { |
Tom Cherry | de6bd50 | 2018-02-13 16:50:08 -0800 | [diff] [blame] | 77 | #if defined(__ANDROID__) |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 78 | return prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_CHOWN, 0, 0) >= 0; |
Tom Cherry | de6bd50 | 2018-02-13 16:50:08 -0800 | [diff] [blame] | 79 | #else |
| 80 | return true; |
| 81 | #endif |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 82 | } |
| 83 | |
| 84 | static unsigned int ComputeLastValidCap() { |
Tom Cherry | de6bd50 | 2018-02-13 16:50:08 -0800 | [diff] [blame] | 85 | #if defined(__ANDROID__) |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 86 | // Android does not support kernels < 3.8. 'CAP_WAKE_ALARM' has been present since 3.0, see |
| 87 | // http://lxr.free-electrons.com/source/include/linux/capability.h?v=3.0#L360. |
| 88 | unsigned int last_valid_cap = CAP_WAKE_ALARM; |
| 89 | for (; prctl(PR_CAPBSET_READ, last_valid_cap, 0, 0, 0) >= 0; ++last_valid_cap); |
| 90 | |
| 91 | // |last_valid_cap| will be the first failing value. |
| 92 | return last_valid_cap - 1; |
Tom Cherry | de6bd50 | 2018-02-13 16:50:08 -0800 | [diff] [blame] | 93 | #else |
| 94 | return CAP_LAST_CAP; |
| 95 | #endif |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 96 | } |
| 97 | |
| 98 | static bool DropBoundingSet(const CapSet& to_keep) { |
| 99 | unsigned int last_valid_cap = GetLastValidCap(); |
| 100 | // When dropping the bounding set, attempt to drop capabilities reported at |
| 101 | // run-time, not at compile-time. |
| 102 | // If the run-time kernel is older than the compile-time headers, this |
| 103 | // avoids dropping an invalid capability. If the run-time kernel is newer |
| 104 | // than the headers, this guarantees all capabilities (even those unknown at |
| 105 | // compile time) will be dropped. |
| 106 | for (size_t cap = 0; cap <= last_valid_cap; ++cap) { |
| 107 | if (cap < to_keep.size() && to_keep.test(cap)) { |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 108 | // No need to drop this capability. |
| 109 | continue; |
| 110 | } |
| 111 | if (cap_drop_bound(cap) == -1) { |
| 112 | PLOG(ERROR) << "cap_drop_bound(" << cap << ") failed"; |
| 113 | return false; |
| 114 | } |
| 115 | } |
| 116 | return true; |
| 117 | } |
| 118 | |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 119 | static bool SetProcCaps(const CapSet& to_keep, bool add_setpcap) { |
Luis Hector Chavez | 7bb3602 | 2017-06-29 09:47:51 -0700 | [diff] [blame] | 120 | ScopedCaps caps(cap_init()); |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 121 | |
Luis Hector Chavez | 7bb3602 | 2017-06-29 09:47:51 -0700 | [diff] [blame] | 122 | cap_clear(caps.get()); |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 123 | cap_value_t value[1]; |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 124 | for (size_t cap = 0; cap < to_keep.size(); ++cap) { |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 125 | if (to_keep.test(cap)) { |
| 126 | value[0] = cap; |
Luis Hector Chavez | 7bb3602 | 2017-06-29 09:47:51 -0700 | [diff] [blame] | 127 | if (cap_set_flag(caps.get(), CAP_INHERITABLE, arraysize(value), value, CAP_SET) != 0 || |
| 128 | cap_set_flag(caps.get(), CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0) { |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 129 | PLOG(ERROR) << "cap_set_flag(INHERITABLE|PERMITTED, " << cap << ") failed"; |
| 130 | return false; |
| 131 | } |
| 132 | } |
| 133 | } |
| 134 | |
| 135 | if (add_setpcap) { |
| 136 | value[0] = CAP_SETPCAP; |
Luis Hector Chavez | 7bb3602 | 2017-06-29 09:47:51 -0700 | [diff] [blame] | 137 | if (cap_set_flag(caps.get(), CAP_PERMITTED, arraysize(value), value, CAP_SET) != 0 || |
| 138 | cap_set_flag(caps.get(), CAP_EFFECTIVE, arraysize(value), value, CAP_SET) != 0) { |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 139 | PLOG(ERROR) << "cap_set_flag(PERMITTED|EFFECTIVE, " << CAP_SETPCAP << ") failed"; |
| 140 | return false; |
| 141 | } |
| 142 | } |
| 143 | |
Luis Hector Chavez | 7bb3602 | 2017-06-29 09:47:51 -0700 | [diff] [blame] | 144 | if (cap_set_proc(caps.get()) != 0) { |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 145 | PLOG(ERROR) << "cap_set_proc(" << to_keep.to_ulong() << ") failed"; |
| 146 | return false; |
| 147 | } |
| 148 | return true; |
| 149 | } |
| 150 | |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 151 | static bool SetAmbientCaps(const CapSet& to_raise) { |
Tom Cherry | de6bd50 | 2018-02-13 16:50:08 -0800 | [diff] [blame] | 152 | #if defined(__ANDROID__) |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 153 | for (size_t cap = 0; cap < to_raise.size(); ++cap) { |
| 154 | if (to_raise.test(cap)) { |
| 155 | if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0) != 0) { |
| 156 | PLOG(ERROR) << "prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, " << cap << ") failed"; |
| 157 | return false; |
| 158 | } |
| 159 | } |
| 160 | } |
Tom Cherry | de6bd50 | 2018-02-13 16:50:08 -0800 | [diff] [blame] | 161 | #endif |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 162 | return true; |
| 163 | } |
| 164 | |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 165 | int LookupCap(const std::string& cap_name) { |
| 166 | auto e = cap_map.find(cap_name); |
| 167 | if (e != cap_map.end()) { |
| 168 | return e->second; |
| 169 | } else { |
| 170 | return -1; |
| 171 | } |
| 172 | } |
| 173 | |
Jorge Lucangeli Obes | f3f824e | 2016-12-15 12:13:38 -0500 | [diff] [blame] | 174 | bool CapAmbientSupported() { |
| 175 | static bool cap_ambient_supported = ComputeCapAmbientSupported(); |
| 176 | return cap_ambient_supported; |
| 177 | } |
| 178 | |
| 179 | unsigned int GetLastValidCap() { |
| 180 | static unsigned int last_valid_cap = ComputeLastValidCap(); |
| 181 | return last_valid_cap; |
| 182 | } |
| 183 | |
Jorge Lucangeli Obes | 24b2913 | 2016-10-27 10:33:03 -0400 | [diff] [blame] | 184 | bool SetCapsForExec(const CapSet& to_keep) { |
| 185 | // Need to keep SETPCAP to drop bounding set below. |
| 186 | bool add_setpcap = true; |
| 187 | if (!SetProcCaps(to_keep, add_setpcap)) { |
| 188 | LOG(ERROR) << "failed to apply initial capset"; |
| 189 | return false; |
| 190 | } |
| 191 | |
| 192 | if (!DropBoundingSet(to_keep)) { |
| 193 | return false; |
| 194 | } |
| 195 | |
| 196 | // If SETPCAP wasn't specifically requested, drop it now. |
| 197 | add_setpcap = false; |
| 198 | if (!SetProcCaps(to_keep, add_setpcap)) { |
| 199 | LOG(ERROR) << "failed to apply final capset"; |
| 200 | return false; |
| 201 | } |
| 202 | |
| 203 | // Add the capabilities to the ambient set so that they are preserved across |
| 204 | // execve(2). |
| 205 | // See http://man7.org/linux/man-pages/man7/capabilities.7.html. |
| 206 | return SetAmbientCaps(to_keep); |
| 207 | } |
Tom Cherry | 81f5d3e | 2017-06-22 12:53:17 -0700 | [diff] [blame] | 208 | |
Luis Hector Chavez | 94fb5b0 | 2017-11-16 15:52:00 -0800 | [diff] [blame] | 209 | bool DropInheritableCaps() { |
| 210 | ScopedCaps caps(cap_get_proc()); |
| 211 | if (cap_clear_flag(caps.get(), CAP_INHERITABLE) == -1) { |
| 212 | PLOG(ERROR) << "cap_clear_flag(INHERITABLE) failed"; |
| 213 | return false; |
| 214 | } |
| 215 | if (cap_set_proc(caps.get()) != 0) { |
| 216 | PLOG(ERROR) << "cap_set_proc() failed"; |
| 217 | return false; |
| 218 | } |
| 219 | return true; |
| 220 | } |
| 221 | |
Tom Cherry | 81f5d3e | 2017-06-22 12:53:17 -0700 | [diff] [blame] | 222 | } // namespace init |
| 223 | } // namespace android |