capability.h 7.3 KB
Newer Older
Linus Torvalds's avatar
Linus Torvalds committed
1 2 3
/*
 * This is <linux/capability.h>
 *
4
 * Andrew G. Morgan <morgan@kernel.org>
Linus Torvalds's avatar
Linus Torvalds committed
5 6 7 8 9
 * Alexander Kjeldaas <astor@guardian.no>
 * with help from Aleph1, Roland Buresund and Andrew Main.
 *
 * See here for the libcap library ("POSIX draft" compliance):
 *
10
 * ftp://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.6/
11
 */
Linus Torvalds's avatar
Linus Torvalds committed
12 13 14
#ifndef _LINUX_CAPABILITY_H
#define _LINUX_CAPABILITY_H

15
#include <uapi/linux/capability.h>
16

17 18 19

#define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3
#define _KERNEL_CAPABILITY_U32S    _LINUX_CAPABILITY_U32S_3
Linus Torvalds's avatar
Linus Torvalds committed
20

21 22
extern int file_caps_enabled;

Linus Torvalds's avatar
Linus Torvalds committed
23
typedef struct kernel_cap_struct {
24
	__u32 cap[_KERNEL_CAPABILITY_U32S];
Linus Torvalds's avatar
Linus Torvalds committed
25 26
} kernel_cap_t;

27 28 29 30 31 32 33
/* exact same as vfs_cap_data but in cpu endian and always filled completely */
struct cpu_vfs_cap_data {
	__u32 magic_etc;
	kernel_cap_t permitted;
	kernel_cap_t inheritable;
};

34
#define _USER_CAP_HEADER_SIZE  (sizeof(struct __user_cap_header_struct))
Linus Torvalds's avatar
Linus Torvalds committed
35 36 37
#define _KERNEL_CAP_T_SIZE     (sizeof(kernel_cap_t))


38
struct file;
39
struct inode;
40
struct dentry;
41
struct task_struct;
42 43 44 45 46
struct user_namespace;

extern const kernel_cap_t __cap_empty_set;
extern const kernel_cap_t __cap_init_eff_set;

Linus Torvalds's avatar
Linus Torvalds committed
47 48 49
/*
 * Internal kernel functions only
 */
50

51
#define CAP_FOR_EACH_U32(__capi)  \
52
	for (__capi = 0; __capi < _KERNEL_CAPABILITY_U32S; ++__capi)
53

54 55 56 57 58 59 60 61 62 63 64 65 66
/*
 * CAP_FS_MASK and CAP_NFSD_MASKS:
 *
 * The fs mask is all the privileges that fsuid==0 historically meant.
 * At one time in the past, that included CAP_MKNOD and CAP_LINUX_IMMUTABLE.
 *
 * It has never meant setting security.* and trusted.* xattrs.
 *
 * We could also define fsmask as follows:
 *   1. CAP_FS_MASK is the privilege to bypass all fs-related DAC permissions
 *   2. The security.* and trusted.* xattrs are fs-related MAC permissions
 */

67
# define CAP_FS_MASK_B0     (CAP_TO_MASK(CAP_CHOWN)		\
68
			    | CAP_TO_MASK(CAP_MKNOD)		\
69 70 71 72 73
			    | CAP_TO_MASK(CAP_DAC_OVERRIDE)	\
			    | CAP_TO_MASK(CAP_DAC_READ_SEARCH)	\
			    | CAP_TO_MASK(CAP_FOWNER)		\
			    | CAP_TO_MASK(CAP_FSETID))

74 75
# define CAP_FS_MASK_B1     (CAP_TO_MASK(CAP_MAC_OVERRIDE))

76
#if _KERNEL_CAPABILITY_U32S != 2
77 78 79
# error Fix up hand-coded capability macro initializers
#else /* HAND-CODED capability initializers */

80 81 82
#define CAP_LAST_U32			((_KERNEL_CAPABILITY_U32S) - 1)
#define CAP_LAST_U32_VALID_MASK		(CAP_TO_MASK(CAP_LAST_CAP + 1) -1)

83
# define CAP_EMPTY_SET    ((kernel_cap_t){{ 0, 0 }})
84
# define CAP_FULL_SET     ((kernel_cap_t){{ ~0, CAP_LAST_U32_VALID_MASK }})
85 86 87
# define CAP_FS_SET       ((kernel_cap_t){{ CAP_FS_MASK_B0 \
				    | CAP_TO_MASK(CAP_LINUX_IMMUTABLE), \
				    CAP_FS_MASK_B1 } })
88
# define CAP_NFSD_SET     ((kernel_cap_t){{ CAP_FS_MASK_B0 \
89 90
				    | CAP_TO_MASK(CAP_SYS_RESOURCE), \
				    CAP_FS_MASK_B1 } })
91

92
#endif /* _KERNEL_CAPABILITY_U32S != 2 */
93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122

# define cap_clear(c)         do { (c) = __cap_empty_set; } while (0)

#define cap_raise(c, flag)  ((c).cap[CAP_TO_INDEX(flag)] |= CAP_TO_MASK(flag))
#define cap_lower(c, flag)  ((c).cap[CAP_TO_INDEX(flag)] &= ~CAP_TO_MASK(flag))
#define cap_raised(c, flag) ((c).cap[CAP_TO_INDEX(flag)] & CAP_TO_MASK(flag))

#define CAP_BOP_ALL(c, a, b, OP)                                    \
do {                                                                \
	unsigned __capi;                                            \
	CAP_FOR_EACH_U32(__capi) {                                  \
		c.cap[__capi] = a.cap[__capi] OP b.cap[__capi];     \
	}                                                           \
} while (0)

#define CAP_UOP_ALL(c, a, OP)                                       \
do {                                                                \
	unsigned __capi;                                            \
	CAP_FOR_EACH_U32(__capi) {                                  \
		c.cap[__capi] = OP a.cap[__capi];                   \
	}                                                           \
} while (0)

static inline kernel_cap_t cap_combine(const kernel_cap_t a,
				       const kernel_cap_t b)
{
	kernel_cap_t dest;
	CAP_BOP_ALL(dest, a, b, |);
	return dest;
}
Linus Torvalds's avatar
Linus Torvalds committed
123

124 125 126 127 128 129 130
static inline kernel_cap_t cap_intersect(const kernel_cap_t a,
					 const kernel_cap_t b)
{
	kernel_cap_t dest;
	CAP_BOP_ALL(dest, a, b, &);
	return dest;
}
Linus Torvalds's avatar
Linus Torvalds committed
131

132 133 134 135 136 137 138
static inline kernel_cap_t cap_drop(const kernel_cap_t a,
				    const kernel_cap_t drop)
{
	kernel_cap_t dest;
	CAP_BOP_ALL(dest, a, drop, &~);
	return dest;
}
Linus Torvalds's avatar
Linus Torvalds committed
139

140 141 142 143 144 145
static inline kernel_cap_t cap_invert(const kernel_cap_t c)
{
	kernel_cap_t dest;
	CAP_UOP_ALL(dest, c, ~);
	return dest;
}
Linus Torvalds's avatar
Linus Torvalds committed
146

147
static inline bool cap_isclear(const kernel_cap_t a)
148 149 150 151
{
	unsigned __capi;
	CAP_FOR_EACH_U32(__capi) {
		if (a.cap[__capi] != 0)
152
			return false;
153
	}
154
	return true;
155
}
Linus Torvalds's avatar
Linus Torvalds committed
156

157 158
/*
 * Check if "a" is a subset of "set".
159 160 161 162
 * return true if ALL of the capabilities in "a" are also in "set"
 *	cap_issubset(0101, 1111) will return true
 * return false if ANY of the capabilities in "a" are not in "set"
 *	cap_issubset(1111, 0101) will return false
163
 */
164
static inline bool cap_issubset(const kernel_cap_t a, const kernel_cap_t set)
165 166 167 168 169
{
	kernel_cap_t dest;
	dest = cap_drop(a, set);
	return cap_isclear(dest);
}
Linus Torvalds's avatar
Linus Torvalds committed
170

171
/* Used to decide between falling back on the old suser() or fsuser(). */
Linus Torvalds's avatar
Linus Torvalds committed
172

173
static inline kernel_cap_t cap_drop_fs_set(const kernel_cap_t a)
Linus Torvalds's avatar
Linus Torvalds committed
174
{
175 176
	const kernel_cap_t __cap_fs_set = CAP_FS_SET;
	return cap_drop(a, __cap_fs_set);
Linus Torvalds's avatar
Linus Torvalds committed
177 178
}

179 180
static inline kernel_cap_t cap_raise_fs_set(const kernel_cap_t a,
					    const kernel_cap_t permitted)
Linus Torvalds's avatar
Linus Torvalds committed
181
{
182 183 184
	const kernel_cap_t __cap_fs_set = CAP_FS_SET;
	return cap_combine(a,
			   cap_intersect(permitted, __cap_fs_set));
Linus Torvalds's avatar
Linus Torvalds committed
185 186
}

187
static inline kernel_cap_t cap_drop_nfsd_set(const kernel_cap_t a)
Linus Torvalds's avatar
Linus Torvalds committed
188
{
189 190
	const kernel_cap_t __cap_fs_set = CAP_NFSD_SET;
	return cap_drop(a, __cap_fs_set);
Linus Torvalds's avatar
Linus Torvalds committed
191 192
}

193 194 195 196 197 198 199
static inline kernel_cap_t cap_raise_nfsd_set(const kernel_cap_t a,
					      const kernel_cap_t permitted)
{
	const kernel_cap_t __cap_nfsd_set = CAP_NFSD_SET;
	return cap_combine(a,
			   cap_intersect(permitted, __cap_nfsd_set));
}
Linus Torvalds's avatar
Linus Torvalds committed
200

201
#ifdef CONFIG_MULTIUSER
202 203 204 205
extern bool has_capability(struct task_struct *t, int cap);
extern bool has_ns_capability(struct task_struct *t,
			      struct user_namespace *ns, int cap);
extern bool has_capability_noaudit(struct task_struct *t, int cap);
206 207
extern bool has_ns_capability_noaudit(struct task_struct *t,
				      struct user_namespace *ns, int cap);
208 209
extern bool capable(int cap);
extern bool ns_capable(struct user_namespace *ns, int cap);
210
extern bool ns_capable_noaudit(struct user_namespace *ns, int cap);
211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237
#else
static inline bool has_capability(struct task_struct *t, int cap)
{
	return true;
}
static inline bool has_ns_capability(struct task_struct *t,
			      struct user_namespace *ns, int cap)
{
	return true;
}
static inline bool has_capability_noaudit(struct task_struct *t, int cap)
{
	return true;
}
static inline bool has_ns_capability_noaudit(struct task_struct *t,
				      struct user_namespace *ns, int cap)
{
	return true;
}
static inline bool capable(int cap)
{
	return true;
}
static inline bool ns_capable(struct user_namespace *ns, int cap)
{
	return true;
}
238 239 240 241
static inline bool ns_capable_noaudit(struct user_namespace *ns, int cap)
{
	return true;
}
242
#endif /* CONFIG_MULTIUSER */
243
extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap);
244
extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
245

246 247 248
/* audit system wants to get cap info from files as well */
extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);

Linus Torvalds's avatar
Linus Torvalds committed
249
#endif /* !_LINUX_CAPABILITY_H */