src/basic/capability-util.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2010 Lennart Poettering
   6
   7   systemd is free software; you can redistribute it and/or modify it
   8   under the terms of the GNU Lesser General Public License as published by
   9   the Free Software Foundation; either version 2.1 of the License, or
  10   (at your option) any later version.
  11
  12   systemd is distributed in the hope that it will be useful, but
  13   WITHOUT ANY WARRANTY; without even the implied warranty of
  14   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  15   Lesser General Public License for more details.
  16
  17   You should have received a copy of the GNU Lesser General Public License
  18   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  19 ***/
  20
  21 #include <errno.h>
  22 #include <grp.h>
  23 #include <stdio.h>
  24 #include <stdlib.h>
  25 #include <sys/capability.h>
  26 #include <sys/prctl.h>
  27 #include <unistd.h>
  28
  29 #include "alloc-util.h"
  30 #include "capability-util.h"
  31 #include "fileio.h"
  32 #include "log.h"
  33 #include "macro.h"
  34 #include "parse-util.h"
  35 #include "user-util.h"
  36 #include "util.h"
  37
  38 int have_effective_cap(int value) {
  39         _cleanup_cap_free_ cap_t cap;
  40         cap_flag_value_t fv;
  41
  42         cap = cap_get_proc();
  43         if (!cap)
  44                 return -errno;
  45
  46         if (cap_get_flag(cap, value, CAP_EFFECTIVE, &fv) < 0)
  47                 return -errno;
  48         else
  49                 return fv == CAP_SET;
  50 }
  51
  52 unsigned long cap_last_cap(void) {
  53         static thread_local unsigned long saved;
  54         static thread_local bool valid = false;
  55         _cleanup_free_ char *content = NULL;
  56         unsigned long p = 0;
  57         int r;
  58
  59         if (valid)
  60                 return saved;
  61
  62         /* available since linux-3.2 */
  63         r = read_one_line_file("/proc/sys/kernel/cap_last_cap", &content);
  64         if (r >= 0) {
  65                 r = safe_atolu(content, &p);
  66                 if (r >= 0) {
  67                         saved = p;
  68                         valid = true;
  69                         return p;
  70                 }
  71         }
  72
  73         /* fall back to syscall-probing for pre linux-3.2 */
  74         p = (unsigned long) CAP_LAST_CAP;
  75
  76         if (prctl(PR_CAPBSET_READ, p) < 0) {
  77
  78                 /* Hmm, look downwards, until we find one that
  79                  * works */
  80                 for (p--; p > 0; p --)
  81                         if (prctl(PR_CAPBSET_READ, p) >= 0)
  82                                 break;
  83
  84         } else {
  85
  86                 /* Hmm, look upwards, until we find one that doesn't
  87                  * work */
  88                 for (;; p++)
  89                         if (prctl(PR_CAPBSET_READ, p+1) < 0)
  90                                 break;
  91         }
  92
  93         saved = p;
  94         valid = true;
  95
  96         return p;
  97 }
  98
  99 int capability_update_inherited_set(cap_t caps, uint64_t set) {
 100         unsigned long i;
 101
 102         /* Add capabilities in the set to the inherited caps. Do not apply
 103          * them yet. */
 104
 105         for (i = 0; i < cap_last_cap(); i++) {
 106
 107                 if (set & (UINT64_C(1) << i)) {
 108                         cap_value_t v;
 109
 110                         v = (cap_value_t) i;
 111
 112                         /* Make the capability inheritable. */
 113                         if (cap_set_flag(caps, CAP_INHERITABLE, 1, &v, CAP_SET) < 0)
 114                                 return -errno;
 115                 }
 116         }
 117
 118         return 0;
 119 }
 120
 121 int capability_ambient_set_apply(uint64_t set, bool also_inherit) {
 122         unsigned long i;
 123         _cleanup_cap_free_ cap_t caps = NULL;
 124
 125         /* Add the capabilities to the ambient set. */
 126
 127         if (also_inherit) {
 128                 int r;
 129                 caps = cap_get_proc();
 130                 if (!caps)
 131                         return -errno;
 132
 133                 r = capability_update_inherited_set(caps, set);
 134                 if (r < 0)
 135                         return -errno;
 136
 137                 if (cap_set_proc(caps) < 0)
 138                         return -errno;
 139         }
 140
 141         for (i = 0; i < cap_last_cap(); i++) {
 142
 143                 if (set & (UINT64_C(1) << i)) {
 144
 145                         /* Add the capability to the ambient set. */
 146                         if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, i, 0, 0) < 0)
 147                                 return -errno;
 148                 }
 149         }
 150
 151         return 0;
 152 }
 153
 154 int capability_bounding_set_drop(uint64_t keep, bool right_now) {
 155         _cleanup_cap_free_ cap_t before_cap = NULL, after_cap = NULL;
 156         cap_flag_value_t fv;
 157         unsigned long i;
 158         int r;
 159
 160         /* If we are run as PID 1 we will lack CAP_SETPCAP by default
 161          * in the effective set (yes, the kernel drops that when
 162          * executing init!), so get it back temporarily so that we can
 163          * call PR_CAPBSET_DROP. */
 164
 165         before_cap = cap_get_proc();
 166         if (!before_cap)
 167                 return -errno;
 168
 169         if (cap_get_flag(before_cap, CAP_SETPCAP, CAP_EFFECTIVE, &fv) < 0)
 170                 return -errno;
 171
 172         if (fv != CAP_SET) {
 173                 _cleanup_cap_free_ cap_t temp_cap = NULL;
 174                 static const cap_value_t v = CAP_SETPCAP;
 175
 176                 temp_cap = cap_dup(before_cap);
 177                 if (!temp_cap)
 178                         return -errno;
 179
 180                 if (cap_set_flag(temp_cap, CAP_EFFECTIVE, 1, &v, CAP_SET) < 0)
 181                         return -errno;
 182
 183                 if (cap_set_proc(temp_cap) < 0)
 184                         log_debug_errno(errno, "Can't acquire effective CAP_SETPCAP bit, ignoring: %m");
 185
 186                 /* If we didn't manage to acquire the CAP_SETPCAP bit, we continue anyway, after all this just means
 187                  * we'll fail later, when we actually intend to drop some capabilities. */
 188         }
 189
 190         after_cap = cap_dup(before_cap);
 191         if (!after_cap)
 192                 return -errno;
 193
 194         for (i = 0; i <= cap_last_cap(); i++) {
 195                 cap_value_t v;
 196
 197                 if ((keep & (UINT64_C(1) << i)))
 198                         continue;
 199
 200                 /* Drop it from the bounding set */
 201                 if (prctl(PR_CAPBSET_DROP, i) < 0) {
 202                         r = -errno;
 203
 204                         /* If dropping the capability failed, let's see if we didn't have it in the first place. If so,
 205                          * continue anyway, as dropping a capability we didn't have in the first place doesn't really
 206                          * matter anyway. */
 207                         if (prctl(PR_CAPBSET_READ, i) != 0)
 208                                 goto finish;
 209                 }
 210                 v = (cap_value_t) i;
 211
 212                 /* Also drop it from the inheritable set, so
 213                  * that anything we exec() loses the
 214                  * capability for good. */
 215                 if (cap_set_flag(after_cap, CAP_INHERITABLE, 1, &v, CAP_CLEAR) < 0) {
 216                         r = -errno;
 217                         goto finish;
 218                 }
 219
 220                 /* If we shall apply this right now drop it
 221                  * also from our own capability sets. */
 222                 if (right_now) {
 223                         if (cap_set_flag(after_cap, CAP_PERMITTED, 1, &v, CAP_CLEAR) < 0 ||
 224                             cap_set_flag(after_cap, CAP_EFFECTIVE, 1, &v, CAP_CLEAR) < 0) {
 225                                 r = -errno;
 226                                 goto finish;
 227                         }
 228                 }
 229         }
 230
 231         r = 0;
 232
 233 finish:
 234         if (cap_set_proc(after_cap) < 0) {
 235                 /* If there are no actual changes anyway then let's ignore this error. */
 236                 if (cap_compare(before_cap, after_cap) != 0)
 237                         r = -errno;
 238         }
 239
 240         return r;
 241 }
 242
 243 static int drop_from_file(const char *fn, uint64_t keep) {
 244         int r, k;
 245         uint32_t hi, lo;
 246         uint64_t current, after;
 247         char *p;
 248
 249         r = read_one_line_file(fn, &p);
 250         if (r < 0)
 251                 return r;
 252
 253         assert_cc(sizeof(hi) == sizeof(unsigned));
 254         assert_cc(sizeof(lo) == sizeof(unsigned));
 255
 256         k = sscanf(p, "%u %u", &lo, &hi);
 257         free(p);
 258
 259         if (k != 2)
 260                 return -EIO;
 261
 262         current = (uint64_t) lo | ((uint64_t) hi << 32ULL);
 263         after = current & keep;
 264
 265         if (current == after)
 266                 return 0;
 267
 268         lo = (unsigned) (after & 0xFFFFFFFFULL);
 269         hi = (unsigned) ((after >> 32ULL) & 0xFFFFFFFFULL);
 270
 271         if (asprintf(&p, "%u %u", lo, hi) < 0)
 272                 return -ENOMEM;
 273
 274         r = write_string_file(fn, p, WRITE_STRING_FILE_CREATE);
 275         free(p);
 276
 277         return r;
 278 }
 279
 280 int capability_bounding_set_drop_usermode(uint64_t keep) {
 281         int r;
 282
 283         r = drop_from_file("/proc/sys/kernel/usermodehelper/inheritable", keep);
 284         if (r < 0)
 285                 return r;
 286
 287         r = drop_from_file("/proc/sys/kernel/usermodehelper/bset", keep);
 288         if (r < 0)
 289                 return r;
 290
 291         return r;
 292 }
 293
 294 int drop_privileges(uid_t uid, gid_t gid, uint64_t keep_capabilities) {
 295         _cleanup_cap_free_ cap_t d = NULL;
 296         unsigned i, j = 0;
 297         int r;
 298
 299         /* Unfortunately we cannot leave privilege dropping to PID 1
 300          * here, since we want to run as user but want to keep some
 301          * capabilities. Since file capabilities have been introduced
 302          * this cannot be done across exec() anymore, unless our
 303          * binary has the capability configured in the file system,
 304          * which we want to avoid. */
 305
 306         if (setresgid(gid, gid, gid) < 0)
 307                 return log_error_errno(errno, "Failed to change group ID: %m");
 308
 309         r = maybe_setgroups(0, NULL);
 310         if (r < 0)
 311                 return log_error_errno(r, "Failed to drop auxiliary groups list: %m");
 312
 313         /* Ensure we keep the permitted caps across the setresuid() */
 314         if (prctl(PR_SET_KEEPCAPS, 1) < 0)
 315                 return log_error_errno(errno, "Failed to enable keep capabilities flag: %m");
 316
 317         r = setresuid(uid, uid, uid);
 318         if (r < 0)
 319                 return log_error_errno(errno, "Failed to change user ID: %m");
 320
 321         if (prctl(PR_SET_KEEPCAPS, 0) < 0)
 322                 return log_error_errno(errno, "Failed to disable keep capabilities flag: %m");
 323
 324         /* Drop all caps from the bounding set, except the ones we want */
 325         r = capability_bounding_set_drop(keep_capabilities, true);
 326         if (r < 0)
 327                 return log_error_errno(r, "Failed to drop capabilities: %m");
 328
 329         /* Now upgrade the permitted caps we still kept to effective caps */
 330         d = cap_init();
 331         if (!d)
 332                 return log_oom();
 333
 334         if (keep_capabilities) {
 335                 cap_value_t bits[u64log2(keep_capabilities) + 1];
 336
 337                 for (i = 0; i < ELEMENTSOF(bits); i++)
 338                         if (keep_capabilities & (1ULL << i))
 339                                 bits[j++] = i;
 340
 341                 /* use enough bits */
 342                 assert(i == 64 || (keep_capabilities >> i) == 0);
 343                 /* don't use too many bits */
 344                 assert(keep_capabilities & (1ULL << (i - 1)));
 345
 346                 if (cap_set_flag(d, CAP_EFFECTIVE, j, bits, CAP_SET) < 0 ||
 347                     cap_set_flag(d, CAP_PERMITTED, j, bits, CAP_SET) < 0)
 348                         return log_error_errno(errno, "Failed to enable capabilities bits: %m");
 349
 350                 if (cap_set_proc(d) < 0)
 351                         return log_error_errno(errno, "Failed to increase capabilities: %m");
 352         }
 353
 354         return 0;
 355 }
 356
 357 int drop_capability(cap_value_t cv) {
 358         _cleanup_cap_free_ cap_t tmp_cap = NULL;
 359
 360         tmp_cap = cap_get_proc();
 361         if (!tmp_cap)
 362                 return -errno;
 363
 364         if ((cap_set_flag(tmp_cap, CAP_INHERITABLE, 1, &cv, CAP_CLEAR) < 0) ||
 365             (cap_set_flag(tmp_cap, CAP_PERMITTED, 1, &cv, CAP_CLEAR) < 0) ||
 366             (cap_set_flag(tmp_cap, CAP_EFFECTIVE, 1, &cv, CAP_CLEAR) < 0))
 367                 return -errno;
 368
 369         if (cap_set_proc(tmp_cap) < 0)
 370                 return -errno;
 371
 372         return 0;
 373 }
 374
 375 bool ambient_capabilities_supported(void) {
 376         static int cache = -1;
 377
 378         if (cache >= 0)
 379                 return cache;
 380
 381         /* If PR_CAP_AMBIENT returns something valid, or an unexpected error code we assume that ambient caps are
 382          * available. */
 383
 384         cache = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, CAP_KILL, 0, 0) >= 0 ||
 385                 !IN_SET(errno, EINVAL, EOPNOTSUPP, ENOSYS);
 386
 387         return cache;
 388 }