Commit 3898b1b4 authored by Andrew G. Morgan's avatar Andrew G. Morgan Committed by Linus Torvalds
Browse files

capabilities: implement per-process securebits 



Filesystem capability support makes it possible to do away with (set)uid-0
based privilege and use capabilities instead.  That is, with filesystem
support for capabilities but without this present patch, it is (conceptually)
possible to manage a system with capabilities alone and never need to obtain
privilege via (set)uid-0.

Of course, conceptually isn't quite the same as currently possible since few
user applications, certainly not enough to run a viable system, are currently
prepared to leverage capabilities to exercise privilege.  Further, many
applications exist that may never get upgraded in this way, and the kernel
will continue to want to support their setuid-0 base privilege needs.

Where pure-capability applications evolve and replace setuid-0 binaries, it is
desirable that there be a mechanisms by which they can contain their
privilege.  In addition to leveraging the per-process bounding and inheritable
sets, this should include suppressing the privilege of the uid-0 superuser
from the process' tree of children.

The feature added by this patch can be leveraged to suppress the privilege
associated with (set)uid-0.  This suppression requires CAP_SETPCAP to
initiate, and only immediately affects the 'current' process (it is inherited
through fork()/exec()).  This reimplementation differs significantly from the
historical support for securebits which was system-wide, unwieldy and which
has ultimately withered to a dead relic in the source of the modern kernel.

With this patch applied a process, that is capable(CAP_SETPCAP), can now drop
all legacy privilege (through uid=0) for itself and all subsequently
fork()'d/exec()'d children with:

  prctl(PR_SET_SECUREBITS, 0x2f);

This patch represents a no-op unless CONFIG_SECURITY_FILE_CAPABILITIES is
enabled at configure time.

[akpm@linux-foundation.org: fix uninitialised var warning]
[serue@us.ibm.com: capabilities: use cap_task_prctl when !CONFIG_SECURITY]
Signed-off-by: default avatarAndrew G. Morgan <morgan@kernel.org>
Acked-by: default avatarSerge Hallyn <serue@us.ibm.com>
Reviewed-by: default avatarJames Morris <jmorris@namei.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Paul Moore <paul.moore@hp.com>
Signed-off-by: default avatarSerge E. Hallyn <serue@us.ibm.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 4016a139

include/linux/capability.h

+1 −2
Original line number Diff line number Diff line
@@ -155,6 +155,7 @@ typedef struct kernel_cap_struct { 
 *   Add any capability from current's capability bounding set

 *       to the current process' inheritable set

 *   Allow taking bits out of capability bounding set

 *   Allow modification of the securebits for a process

 */



#define CAP_SETPCAP          8
@@ -490,8 +491,6 @@ extern const kernel_cap_t __cap_init_eff_set; 
int capable(int cap);

int __capable(struct task_struct *t, int cap);



extern long cap_prctl_drop(unsigned long cap);



#endif /* __KERNEL__ */



#endif /* !_LINUX_CAPABILITY_H */

include/linux/init_task.h

+2 −1
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ 
#include <linux/ipc.h>

#include <linux/pid_namespace.h>

#include <linux/user_namespace.h>

#include <linux/securebits.h>

#include <net/net_namespace.h>



#define INIT_FDTABLE \
@@ -172,7 +173,7 @@ extern struct group_info init_groups; 
	.cap_inheritable = CAP_INIT_INH_SET,				\

	.cap_permitted	= CAP_FULL_SET,					\

	.cap_bset 	= CAP_INIT_BSET,				\

	.keep_capabilities = 0,						\

	.securebits     = SECUREBITS_DEFAULT,				\

	.user		= INIT_USER,					\

	.comm		= "swapper",					\

	.thread		= INIT_THREAD,					\

include/linux/prctl.h

+7 −2
Original line number Diff line number Diff line
@@ -16,7 +16,8 @@ 
# define PR_UNALIGN_NOPRINT	1	/* silently fix up unaligned user accesses */

# define PR_UNALIGN_SIGBUS	2	/* generate SIGBUS on unaligned user access */



/* Get/set whether or not to drop capabilities on setuid() away from uid 0 */

/* Get/set whether or not to drop capabilities on setuid() away from

 * uid 0 (as per security/commoncap.c) */

#define PR_GET_KEEPCAPS   7

#define PR_SET_KEEPCAPS   8
@@ -63,7 +64,7 @@ 
#define PR_GET_SECCOMP	21

#define PR_SET_SECCOMP	22



/* Get/set the capability bounding set */

/* Get/set the capability bounding set (as per security/commoncap.c) */

#define PR_CAPBSET_READ 23

#define PR_CAPBSET_DROP 24
@@ -73,4 +74,8 @@ 
# define PR_TSC_ENABLE		1	/* allow the use of the timestamp counter */

# define PR_TSC_SIGSEGV		2	/* throw a SIGSEGV instead of reading the TSC */



/* Get/set securebits (as per security/commoncap.c) */

#define PR_GET_SECUREBITS 27

#define PR_SET_SECUREBITS 28



#endif /* _LINUX_PRCTL_H */

include/linux/sched.h

+1 −2
Original line number Diff line number Diff line
@@ -68,7 +68,6 @@ struct sched_param { 
#include <linux/smp.h>

#include <linux/sem.h>

#include <linux/signal.h>

#include <linux/securebits.h>

#include <linux/fs_struct.h>

#include <linux/compiler.h>

#include <linux/completion.h>
@@ -1133,7 +1132,7 @@ struct task_struct { 
	gid_t gid,egid,sgid,fsgid;

	struct group_info *group_info;

	kernel_cap_t   cap_effective, cap_inheritable, cap_permitted, cap_bset;

	unsigned keep_capabilities:1;

	unsigned securebits;

	struct user_struct *user;

#ifdef CONFIG_KEYS

	struct key *request_key_auth;	/* assumed request_key authority */

include/linux/securebits.h

+18 −7
Original line number Diff line number Diff line
@@ -3,8 +3,6 @@ 


#define SECUREBITS_DEFAULT 0x00000000



extern unsigned securebits;



/* When set UID 0 has no special privileges. When unset, we support

   inheritance of root-permissions and suid-root executable under

   compatibility mode. We raise the effective and inheritable bitmasks
@@ -12,19 +10,32 @@ extern unsigned securebits; 
   0. If the real uid is 0, we raise the inheritable bitmask of the

   executable file. */

#define SECURE_NOROOT			0

#define SECURE_NOROOT_LOCKED		1  /* make bit-0 immutable */



/* When set, setuid to/from uid 0 does not trigger capability-"fixes"

   to be compatible with old programs relying on set*uid to loose

   privileges. When unset, setuid doesn't change privileges. */

#define SECURE_NO_SETUID_FIXUP		2

#define SECURE_NO_SETUID_FIXUP_LOCKED	3  /* make bit-2 immutable */



/* When set, a process can retain its capabilities even after

   transitioning to a non-root user (the set-uid fixup suppressed by

   bit 2). Bit-4 is cleared when a process calls exec(); setting both

   bit 4 and 5 will create a barrier through exec that no exec()'d

   child can use this feature again. */

#define SECURE_KEEP_CAPS		4

#define SECURE_KEEP_CAPS_LOCKED		5  /* make bit-4 immutable */



/* Each securesetting is implemented using two bits. One bit specify

   whether the setting is on or off. The other bit specify whether the

   setting is fixed or not. A setting which is fixed cannot be changed

   from user-level. */

#define issecure_mask(X)	(1 << (X))

#define issecure(X)		(issecure_mask(X) & current->securebits)



#define issecure(X) ( (1 << (X+1)) & SECUREBITS_DEFAULT ? 	\

		      (1 << (X)) & SECUREBITS_DEFAULT :		\

		      (1 << (X)) & securebits )

#define SECURE_ALL_BITS		(issecure_mask(SECURE_NOROOT) | \

				 issecure_mask(SECURE_NO_SETUID_FIXUP) | \

				 issecure_mask(SECURE_KEEP_CAPS))

#define SECURE_ALL_LOCKS	(SECURE_ALL_BITS << 1)



#endif /* !_LINUX_SECUREBITS_H */

CRA Git | Maintained and supported by SUSTech CRA and CCSE