fcaps: clear the same personality flags as suid when fcaps are used
[linux-2.6.git] / security / commoncap.c
index a83e607..5ec6bc2 100644 (file)
 #include <linux/sched.h>
 #include <linux/prctl.h>
 #include <linux/securebits.h>
+#include <linux/user_namespace.h>
+#include <linux/binfmts.h>
+
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
+#include <linux/android_aid.h>
+#endif
 
 /*
  * If a non-root user executes a setuid-root binary in
@@ -55,18 +61,10 @@ int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
        return 0;
 }
 
-int cap_netlink_recv(struct sk_buff *skb, int cap)
-{
-       if (!cap_raised(current_cap(), cap))
-               return -EPERM;
-       return 0;
-}
-EXPORT_SYMBOL(cap_netlink_recv);
-
 /**
  * cap_capable - Determine whether a task has a particular effective capability
- * @tsk: The task to query
  * @cred: The credentials to use
+ * @ns:  The user namespace in which we need the capability
  * @cap: The capability to check for
  * @audit: Whether to write an audit message or not
  *
@@ -78,10 +76,36 @@ EXPORT_SYMBOL(cap_netlink_recv);
  * cap_has_capability() returns 0 when a task has a capability, but the
  * kernel's capable() and has_capability() returns 1 for this case.
  */
-int cap_capable(struct task_struct *tsk, const struct cred *cred, int cap,
-               int audit)
+int cap_capable(const struct cred *cred, struct user_namespace *targ_ns,
+               int cap, int audit)
 {
-       return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
+#ifdef CONFIG_ANDROID_PARANOID_NETWORK
+       if (cap == CAP_NET_RAW && in_egroup_p(AID_NET_RAW))
+               return 0;
+       if (cap == CAP_NET_ADMIN && in_egroup_p(AID_NET_ADMIN))
+               return 0;
+#endif
+       for (;;) {
+               /* The creator of the user namespace has all caps. */
+               if (targ_ns != &init_user_ns && targ_ns->creator == cred->user)
+                       return 0;
+
+               /* Do we have the necessary capabilities? */
+               if (targ_ns == cred->user->user_ns)
+                       return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
+
+               /* Have we tried all of the parent namespaces? */
+               if (targ_ns == &init_user_ns)
+                       return -EPERM;
+
+               /*
+                *If you have a capability in a parent user ns, then you have
+                * it over all children user namespaces as well.
+                */
+               targ_ns = targ_ns->creator->user_ns;
+       }
+
+       /* We never get here */
 }
 
 /**
@@ -92,7 +116,7 @@ int cap_capable(struct task_struct *tsk, const struct cred *cred, int cap,
  * Determine whether the current process may set the system clock and timezone
  * information, returning 0 if permission granted, -ve if denied.
  */
-int cap_settime(struct timespec *ts, struct timezone *tz)
+int cap_settime(const struct timespec *ts, const struct timezone *tz)
 {
        if (!capable(CAP_SYS_TIME))
                return -EPERM;
@@ -105,18 +129,30 @@ int cap_settime(struct timespec *ts, struct timezone *tz)
  * @child: The process to be accessed
  * @mode: The mode of attachment.
  *
+ * If we are in the same or an ancestor user_ns and have all the target
+ * task's capabilities, then ptrace access is allowed.
+ * If we have the ptrace capability to the target user_ns, then ptrace
+ * access is allowed.
+ * Else denied.
+ *
  * Determine whether a process may access another, returning 0 if permission
  * granted, -ve if denied.
  */
 int cap_ptrace_access_check(struct task_struct *child, unsigned int mode)
 {
        int ret = 0;
+       const struct cred *cred, *child_cred;
 
        rcu_read_lock();
-       if (!cap_issubset(__task_cred(child)->cap_permitted,
-                         current_cred()->cap_permitted) &&
-           !capable(CAP_SYS_PTRACE))
-               ret = -EPERM;
+       cred = current_cred();
+       child_cred = __task_cred(child);
+       if (cred->user->user_ns == child_cred->user->user_ns &&
+           cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
+               goto out;
+       if (ns_capable(child_cred->user->user_ns, CAP_SYS_PTRACE))
+               goto out;
+       ret = -EPERM;
+out:
        rcu_read_unlock();
        return ret;
 }
@@ -125,18 +161,30 @@ int cap_ptrace_access_check(struct task_struct *child, unsigned int mode)
  * cap_ptrace_traceme - Determine whether another process may trace the current
  * @parent: The task proposed to be the tracer
  *
+ * If parent is in the same or an ancestor user_ns and has all current's
+ * capabilities, then ptrace access is allowed.
+ * If parent has the ptrace capability to current's user_ns, then ptrace
+ * access is allowed.
+ * Else denied.
+ *
  * Determine whether the nominated task is permitted to trace the current
  * process, returning 0 if permission is granted, -ve if denied.
  */
 int cap_ptrace_traceme(struct task_struct *parent)
 {
        int ret = 0;
+       const struct cred *cred, *child_cred;
 
        rcu_read_lock();
-       if (!cap_issubset(current_cred()->cap_permitted,
-                         __task_cred(parent)->cap_permitted) &&
-           !has_capability(parent, CAP_SYS_PTRACE))
-               ret = -EPERM;
+       cred = __task_cred(parent);
+       child_cred = current_cred();
+       if (cred->user->user_ns == child_cred->user->user_ns &&
+           cap_issubset(child_cred->cap_permitted, cred->cap_permitted))
+               goto out;
+       if (has_ns_capability(parent, child_cred->user->user_ns, CAP_SYS_PTRACE))
+               goto out;
+       ret = -EPERM;
+out:
        rcu_read_unlock();
        return ret;
 }
@@ -176,8 +224,8 @@ static inline int cap_inh_is_capped(void)
        /* they are so limited unless the current task has the CAP_SETPCAP
         * capability
         */
-       if (cap_capable(current, current_cred(), CAP_SETPCAP,
-                       SECURITY_CAP_AUDIT) == 0)
+       if (cap_capable(current_cred(), current_cred()->user->user_ns,
+                       CAP_SETPCAP, SECURITY_CAP_AUDIT) == 0)
                return 0;
        return 1;
 }
@@ -285,7 +333,8 @@ int cap_inode_killpriv(struct dentry *dentry)
  */
 static inline int bprm_caps_from_vfs_caps(struct cpu_vfs_cap_data *caps,
                                          struct linux_binprm *bprm,
-                                         bool *effective)
+                                         bool *effective,
+                                         bool *has_cap)
 {
        struct cred *new = bprm->cred;
        unsigned i;
@@ -294,6 +343,9 @@ static inline int bprm_caps_from_vfs_caps(struct cpu_vfs_cap_data *caps,
        if (caps->magic_etc & VFS_CAP_FLAGS_EFFECTIVE)
                *effective = true;
 
+       if (caps->magic_etc & VFS_CAP_REVISION_MASK)
+               *has_cap = true;
+
        CAP_FOR_EACH_U32(i) {
                __u32 permitted = caps->permitted.cap[i];
                __u32 inheritable = caps->inheritable.cap[i];
@@ -377,7 +429,7 @@ int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data
  * its xattrs and, if present, apply them to the proposed credentials being
  * constructed by execve().
  */
-static int get_file_caps(struct linux_binprm *bprm, bool *effective)
+static int get_file_caps(struct linux_binprm *bprm, bool *effective, bool *has_cap)
 {
        struct dentry *dentry;
        int rc = 0;
@@ -403,7 +455,7 @@ static int get_file_caps(struct linux_binprm *bprm, bool *effective)
                goto out;
        }
 
-       rc = bprm_caps_from_vfs_caps(&vcaps, bprm, effective);
+       rc = bprm_caps_from_vfs_caps(&vcaps, bprm, effective, has_cap);
        if (rc == -EINVAL)
                printk(KERN_NOTICE "%s: cap_from_disk returned %d for %s\n",
                       __func__, rc, bprm->filename);
@@ -428,11 +480,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
 {
        const struct cred *old = current_cred();
        struct cred *new = bprm->cred;
-       bool effective;
+       bool effective, has_cap = false;
        int ret;
 
        effective = false;
-       ret = get_file_caps(bprm, &effective);
+       ret = get_file_caps(bprm, &effective, &has_cap);
        if (ret < 0)
                return ret;
 
@@ -442,7 +494,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
                 * for a setuid root binary run by a non-root user.  Do set it
                 * for a root user just to cause least surprise to an admin.
                 */
-               if (effective && new->uid != 0 && new->euid == 0) {
+               if (has_cap && new->uid != 0 && new->euid == 0) {
                        warn_setuid_and_fcaps_mixed(bprm->filename);
                        goto skip;
                }
@@ -463,6 +515,11 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
        }
 skip:
 
+       /* if we have fs caps, clear dangerous personality flags */
+       if (!cap_issubset(new->cap_permitted, old->cap_permitted))
+               bprm->per_clear |= PER_CLEAR_ON_SETID;
+
+
        /* Don't let someone trace a set[ug]id/setpcap binary with the revised
         * credentials unless they have the appropriate permit
         */
@@ -482,15 +539,10 @@ skip:
        new->suid = new->fsuid = new->euid;
        new->sgid = new->fsgid = new->egid;
 
-       /* For init, we want to retain the capabilities set in the initial
-        * task.  Thus we skip the usual capability rules
-        */
-       if (!is_global_init(current)) {
-               if (effective)
-                       new->cap_effective = new->cap_permitted;
-               else
-                       cap_clear(new->cap_effective);
-       }
+       if (effective)
+               new->cap_effective = new->cap_permitted;
+       else
+               cap_clear(new->cap_effective);
        bprm->cap_effective = effective;
 
        /*
@@ -828,7 +880,8 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
                     & (new->securebits ^ arg2))                        /*[1]*/
                    || ((new->securebits & SECURE_ALL_LOCKS & ~arg2))   /*[2]*/
                    || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS))   /*[3]*/
-                   || (cap_capable(current, current_cred(), CAP_SETPCAP,
+                   || (cap_capable(current_cred(),
+                                   current_cred()->user->user_ns, CAP_SETPCAP,
                                    SECURITY_CAP_AUDIT) != 0)           /*[4]*/
                        /*
                         * [1] no changing of bits that are locked
@@ -893,7 +946,7 @@ int cap_vm_enough_memory(struct mm_struct *mm, long pages)
 {
        int cap_sys_admin = 0;
 
-       if (cap_capable(current, current_cred(), CAP_SYS_ADMIN,
+       if (cap_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
                        SECURITY_CAP_NOAUDIT) == 0)
                cap_sys_admin = 1;
        return __vm_enough_memory(mm, pages, cap_sys_admin);
@@ -920,7 +973,7 @@ int cap_file_mmap(struct file *file, unsigned long reqprot,
        int ret = 0;
 
        if (addr < dac_mmap_min_addr) {
-               ret = cap_capable(current, current_cred(), CAP_SYS_RAWIO,
+               ret = cap_capable(current_cred(), &init_user_ns, CAP_SYS_RAWIO,
                                  SECURITY_CAP_AUDIT);
                /* set PF_SUPERPRIV if it turns out we allow the low mmap */
                if (ret == 0)