1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause 3 * 4 * Copyright (c) 2013 FreeBSD Foundation 5 * 6 * This software was developed by Pawel Jakub Dawidek under sponsorship from 7 * the FreeBSD Foundation. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28 * SUCH DAMAGE. 29 */ 30 31 #include <sys/cdefs.h> 32 /* 33 * Note that this file is compiled into the kernel and into libc. 34 */ 35 36 #include <sys/types.h> 37 #include <sys/capsicum.h> 38 39 #ifdef _KERNEL 40 #include <sys/systm.h> 41 #include <sys/kernel.h> 42 #include <machine/stdarg.h> 43 #else /* !_KERNEL */ 44 #include <assert.h> 45 #include <stdarg.h> 46 #include <stdbool.h> 47 #include <stdint.h> 48 #include <string.h> 49 #endif 50 51 #ifdef _KERNEL 52 #define assert(exp) KASSERT((exp), ("%s:%u", __func__, __LINE__)) 53 __read_mostly cap_rights_t cap_accept_rights; 54 __read_mostly cap_rights_t cap_bind_rights; 55 __read_mostly cap_rights_t cap_chflags_rights; 56 __read_mostly cap_rights_t cap_connect_rights; 57 __read_mostly cap_rights_t cap_event_rights; 58 __read_mostly cap_rights_t cap_fchdir_rights; 59 __read_mostly cap_rights_t cap_fchflags_rights; 60 __read_mostly cap_rights_t cap_fchmod_rights; 61 __read_mostly cap_rights_t cap_fchown_rights; 62 __read_mostly cap_rights_t cap_fchroot_rights; 63 __read_mostly cap_rights_t cap_fcntl_rights; 64 __read_mostly cap_rights_t cap_fexecve_rights; 65 __read_mostly cap_rights_t cap_flock_rights; 66 __read_mostly cap_rights_t cap_fpathconf_rights; 67 __read_mostly cap_rights_t cap_fstat_rights; 68 __read_mostly cap_rights_t cap_fstatfs_rights; 69 __read_mostly cap_rights_t cap_fsync_rights; 70 __read_mostly cap_rights_t cap_ftruncate_rights; 71 __read_mostly cap_rights_t cap_futimes_rights; 72 __read_mostly cap_rights_t cap_getpeername_rights; 73 __read_mostly cap_rights_t cap_getsockopt_rights; 74 __read_mostly cap_rights_t cap_getsockname_rights; 75 __read_mostly cap_rights_t cap_ioctl_rights; 76 __read_mostly cap_rights_t cap_listen_rights; 77 __read_mostly cap_rights_t cap_linkat_source_rights; 78 __read_mostly cap_rights_t cap_linkat_target_rights; 79 __read_mostly cap_rights_t cap_mmap_rights; 80 __read_mostly cap_rights_t cap_mkdirat_rights; 81 __read_mostly cap_rights_t cap_mkfifoat_rights; 82 __read_mostly cap_rights_t cap_mknodat_rights; 83 __read_mostly cap_rights_t cap_pdgetpid_rights; 84 __read_mostly cap_rights_t cap_pdkill_rights; 85 __read_mostly cap_rights_t cap_pread_rights; 86 __read_mostly cap_rights_t cap_pwrite_rights; 87 __read_mostly cap_rights_t cap_read_rights; 88 __read_mostly cap_rights_t cap_recv_rights; 89 __read_mostly cap_rights_t cap_renameat_source_rights; 90 __read_mostly cap_rights_t cap_renameat_target_rights; 91 __read_mostly cap_rights_t cap_seek_rights; 92 __read_mostly cap_rights_t cap_send_rights; 93 __read_mostly cap_rights_t cap_send_connect_rights; 94 __read_mostly cap_rights_t cap_setsockopt_rights; 95 __read_mostly cap_rights_t cap_shutdown_rights; 96 __read_mostly cap_rights_t cap_symlinkat_rights; 97 __read_mostly cap_rights_t cap_unlinkat_rights; 98 __read_mostly cap_rights_t cap_write_rights; 99 __read_mostly cap_rights_t cap_no_rights; 100 101 static void 102 cap_rights_sysinit(void *arg) 103 { 104 cap_rights_init_one(&cap_accept_rights, CAP_ACCEPT); 105 cap_rights_init_one(&cap_bind_rights, CAP_BIND); 106 cap_rights_init_one(&cap_connect_rights, CAP_CONNECT); 107 cap_rights_init_one(&cap_event_rights, CAP_EVENT); 108 cap_rights_init_one(&cap_fchdir_rights, CAP_FCHDIR); 109 cap_rights_init_one(&cap_fchflags_rights, CAP_FCHFLAGS); 110 cap_rights_init_one(&cap_fchmod_rights, CAP_FCHMOD); 111 cap_rights_init_one(&cap_fchown_rights, CAP_FCHOWN); 112 cap_rights_init_one(&cap_fchroot_rights, CAP_FCHROOT); 113 cap_rights_init_one(&cap_fcntl_rights, CAP_FCNTL); 114 cap_rights_init_one(&cap_fexecve_rights, CAP_FEXECVE); 115 cap_rights_init_one(&cap_flock_rights, CAP_FLOCK); 116 cap_rights_init_one(&cap_fpathconf_rights, CAP_FPATHCONF); 117 cap_rights_init_one(&cap_fstat_rights, CAP_FSTAT); 118 cap_rights_init_one(&cap_fstatfs_rights, CAP_FSTATFS); 119 cap_rights_init_one(&cap_fsync_rights, CAP_FSYNC); 120 cap_rights_init_one(&cap_ftruncate_rights, CAP_FTRUNCATE); 121 cap_rights_init_one(&cap_futimes_rights, CAP_FUTIMES); 122 cap_rights_init_one(&cap_getpeername_rights, CAP_GETPEERNAME); 123 cap_rights_init_one(&cap_getsockname_rights, CAP_GETSOCKNAME); 124 cap_rights_init_one(&cap_getsockopt_rights, CAP_GETSOCKOPT); 125 cap_rights_init_one(&cap_ioctl_rights, CAP_IOCTL); 126 cap_rights_init_one(&cap_linkat_source_rights, CAP_LINKAT_SOURCE); 127 cap_rights_init_one(&cap_linkat_target_rights, CAP_LINKAT_TARGET); 128 cap_rights_init_one(&cap_listen_rights, CAP_LISTEN); 129 cap_rights_init_one(&cap_mkdirat_rights, CAP_MKDIRAT); 130 cap_rights_init_one(&cap_mkfifoat_rights, CAP_MKFIFOAT); 131 cap_rights_init_one(&cap_mknodat_rights, CAP_MKNODAT); 132 cap_rights_init_one(&cap_mmap_rights, CAP_MMAP); 133 cap_rights_init_one(&cap_pdgetpid_rights, CAP_PDGETPID); 134 cap_rights_init_one(&cap_pdkill_rights, CAP_PDKILL); 135 cap_rights_init_one(&cap_pread_rights, CAP_PREAD); 136 cap_rights_init_one(&cap_pwrite_rights, CAP_PWRITE); 137 cap_rights_init_one(&cap_read_rights, CAP_READ); 138 cap_rights_init_one(&cap_recv_rights, CAP_RECV); 139 cap_rights_init_one(&cap_renameat_source_rights, CAP_RENAMEAT_SOURCE); 140 cap_rights_init_one(&cap_renameat_target_rights, CAP_RENAMEAT_TARGET); 141 cap_rights_init_one(&cap_seek_rights, CAP_SEEK); 142 cap_rights_init_one(&cap_send_rights, CAP_SEND); 143 cap_rights_init(&cap_send_connect_rights, CAP_SEND, CAP_CONNECT); 144 cap_rights_init_one(&cap_setsockopt_rights, CAP_SETSOCKOPT); 145 cap_rights_init_one(&cap_shutdown_rights, CAP_SHUTDOWN); 146 cap_rights_init_one(&cap_symlinkat_rights, CAP_SYMLINKAT); 147 cap_rights_init_one(&cap_unlinkat_rights, CAP_UNLINKAT); 148 cap_rights_init_one(&cap_write_rights, CAP_WRITE); 149 cap_rights_init(&cap_no_rights); 150 } 151 SYSINIT(cap_rights_sysinit, SI_SUB_COPYRIGHT, SI_ORDER_ANY, cap_rights_sysinit, 152 NULL); 153 154 #endif 155 156 #define CAPARSIZE_MIN (CAP_RIGHTS_VERSION_00 + 2) 157 #define CAPARSIZE_MAX (CAP_RIGHTS_VERSION + 2) 158 159 static __inline int 160 right_to_index(uint64_t right) 161 { 162 static const int bit2idx[] = { 163 -1, 0, 1, -1, 2, -1, -1, -1, 3, -1, -1, -1, -1, -1, -1, -1, 164 4, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1 165 }; 166 int idx; 167 168 idx = CAPIDXBIT(right); 169 assert(idx >= 0 && idx < sizeof(bit2idx) / sizeof(bit2idx[0])); 170 return (bit2idx[idx]); 171 } 172 173 static void 174 cap_rights_vset(cap_rights_t *rights, va_list ap) 175 { 176 uint64_t right; 177 int i, n __unused; 178 179 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 180 181 n = CAPARSIZE(rights); 182 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 183 184 for (;;) { 185 right = (uint64_t)va_arg(ap, unsigned long long); 186 if (right == 0) 187 break; 188 assert(CAPRVER(right) == 0); 189 i = right_to_index(right); 190 assert(i >= 0); 191 assert(i < n); 192 assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right)); 193 rights->cr_rights[i] |= right; 194 assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right)); 195 } 196 } 197 198 static void 199 cap_rights_vclear(cap_rights_t *rights, va_list ap) 200 { 201 uint64_t right; 202 int i, n __unused; 203 204 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 205 206 n = CAPARSIZE(rights); 207 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 208 209 for (;;) { 210 right = (uint64_t)va_arg(ap, unsigned long long); 211 if (right == 0) 212 break; 213 assert(CAPRVER(right) == 0); 214 i = right_to_index(right); 215 assert(i >= 0); 216 assert(i < n); 217 assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right)); 218 rights->cr_rights[i] &= ~(right & 0x01FFFFFFFFFFFFFFULL); 219 assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right)); 220 } 221 } 222 223 static bool 224 cap_rights_is_vset(const cap_rights_t *rights, va_list ap) 225 { 226 uint64_t right; 227 int i, n __unused; 228 229 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 230 231 n = CAPARSIZE(rights); 232 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 233 234 for (;;) { 235 right = (uint64_t)va_arg(ap, unsigned long long); 236 if (right == 0) 237 break; 238 assert(CAPRVER(right) == 0); 239 i = right_to_index(right); 240 assert(i >= 0); 241 assert(i < n); 242 assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right)); 243 if ((rights->cr_rights[i] & right) != right) 244 return (false); 245 } 246 247 return (true); 248 } 249 250 cap_rights_t * 251 __cap_rights_init(int version, cap_rights_t *rights, ...) 252 { 253 unsigned int n __unused; 254 va_list ap; 255 256 assert(version == CAP_RIGHTS_VERSION_00); 257 258 n = version + 2; 259 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 260 CAP_NONE(rights); 261 va_start(ap, rights); 262 cap_rights_vset(rights, ap); 263 va_end(ap); 264 265 return (rights); 266 } 267 268 cap_rights_t * 269 __cap_rights_set(cap_rights_t *rights, ...) 270 { 271 va_list ap; 272 273 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 274 275 va_start(ap, rights); 276 cap_rights_vset(rights, ap); 277 va_end(ap); 278 279 return (rights); 280 } 281 282 cap_rights_t * 283 __cap_rights_clear(cap_rights_t *rights, ...) 284 { 285 va_list ap; 286 287 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 288 289 va_start(ap, rights); 290 cap_rights_vclear(rights, ap); 291 va_end(ap); 292 293 return (rights); 294 } 295 296 bool 297 __cap_rights_is_set(const cap_rights_t *rights, ...) 298 { 299 va_list ap; 300 bool ret; 301 302 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 303 304 va_start(ap, rights); 305 ret = cap_rights_is_vset(rights, ap); 306 va_end(ap); 307 308 return (ret); 309 } 310 311 bool 312 cap_rights_is_empty(const cap_rights_t *rights) 313 { 314 #ifndef _KERNEL 315 cap_rights_t cap_no_rights; 316 cap_rights_init(&cap_no_rights); 317 #endif 318 319 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 320 assert(CAPVER(&cap_no_rights) == CAP_RIGHTS_VERSION_00); 321 322 for (int i = 0; i < CAPARSIZE(rights); i++) { 323 if (rights->cr_rights[i] != cap_no_rights.cr_rights[i]) 324 return (false); 325 } 326 327 return (true); 328 } 329 330 bool 331 cap_rights_is_valid(const cap_rights_t *rights) 332 { 333 cap_rights_t allrights; 334 int i, j; 335 336 if (CAPVER(rights) != CAP_RIGHTS_VERSION_00) 337 return (false); 338 if (CAPARSIZE(rights) < CAPARSIZE_MIN || 339 CAPARSIZE(rights) > CAPARSIZE_MAX) { 340 return (false); 341 } 342 CAP_ALL(&allrights); 343 if (!cap_rights_contains(&allrights, rights)) 344 return (false); 345 for (i = 0; i < CAPARSIZE(rights); i++) { 346 j = right_to_index(rights->cr_rights[i]); 347 if (i != j) 348 return (false); 349 if (i > 0) { 350 if (CAPRVER(rights->cr_rights[i]) != 0) 351 return (false); 352 } 353 } 354 355 return (true); 356 } 357 358 cap_rights_t * 359 cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src) 360 { 361 unsigned int i, n; 362 363 assert(CAPVER(dst) == CAP_RIGHTS_VERSION_00); 364 assert(CAPVER(src) == CAP_RIGHTS_VERSION_00); 365 assert(CAPVER(dst) == CAPVER(src)); 366 assert(cap_rights_is_valid(src)); 367 assert(cap_rights_is_valid(dst)); 368 369 n = CAPARSIZE(dst); 370 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 371 372 for (i = 0; i < n; i++) 373 dst->cr_rights[i] |= src->cr_rights[i]; 374 375 assert(cap_rights_is_valid(src)); 376 assert(cap_rights_is_valid(dst)); 377 378 return (dst); 379 } 380 381 cap_rights_t * 382 cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src) 383 { 384 unsigned int i, n; 385 386 assert(CAPVER(dst) == CAP_RIGHTS_VERSION_00); 387 assert(CAPVER(src) == CAP_RIGHTS_VERSION_00); 388 assert(CAPVER(dst) == CAPVER(src)); 389 assert(cap_rights_is_valid(src)); 390 assert(cap_rights_is_valid(dst)); 391 392 n = CAPARSIZE(dst); 393 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 394 395 for (i = 0; i < n; i++) { 396 dst->cr_rights[i] &= 397 ~(src->cr_rights[i] & 0x01FFFFFFFFFFFFFFULL); 398 } 399 400 assert(cap_rights_is_valid(src)); 401 assert(cap_rights_is_valid(dst)); 402 403 return (dst); 404 } 405 406 #ifndef _KERNEL 407 bool 408 cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little) 409 { 410 unsigned int i, n; 411 412 assert(CAPVER(big) == CAP_RIGHTS_VERSION_00); 413 assert(CAPVER(little) == CAP_RIGHTS_VERSION_00); 414 assert(CAPVER(big) == CAPVER(little)); 415 416 n = CAPARSIZE(big); 417 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 418 419 for (i = 0; i < n; i++) { 420 if ((big->cr_rights[i] & little->cr_rights[i]) != 421 little->cr_rights[i]) { 422 return (false); 423 } 424 } 425 426 return (true); 427 } 428 #endif 429