1 /*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 2013 FreeBSD Foundation 5 * All rights reserved. 6 * 7 * This software was developed by Pawel Jakub Dawidek under sponsorship from 8 * the FreeBSD Foundation. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 __FBSDID("$FreeBSD$"); 34 35 /* 36 * Note that this file is compiled into the kernel and into libc. 37 */ 38 39 #include <sys/types.h> 40 #include <sys/capsicum.h> 41 42 #ifdef _KERNEL 43 #include <sys/systm.h> 44 #include <sys/kernel.h> 45 #include <machine/stdarg.h> 46 #else /* !_KERNEL */ 47 #include <assert.h> 48 #include <stdarg.h> 49 #include <stdbool.h> 50 #include <stdint.h> 51 #include <string.h> 52 #endif 53 54 #ifdef _KERNEL 55 #define assert(exp) KASSERT((exp), ("%s:%u", __func__, __LINE__)) 56 __read_mostly cap_rights_t cap_accept_rights; 57 __read_mostly cap_rights_t cap_bind_rights; 58 __read_mostly cap_rights_t cap_chflags_rights; 59 __read_mostly cap_rights_t cap_connect_rights; 60 __read_mostly cap_rights_t cap_event_rights; 61 __read_mostly cap_rights_t cap_fchdir_rights; 62 __read_mostly cap_rights_t cap_fchflags_rights; 63 __read_mostly cap_rights_t cap_fchmod_rights; 64 __read_mostly cap_rights_t cap_fchown_rights; 65 __read_mostly cap_rights_t cap_fcntl_rights; 66 __read_mostly cap_rights_t cap_fexecve_rights; 67 __read_mostly cap_rights_t cap_flock_rights; 68 __read_mostly cap_rights_t cap_fpathconf_rights; 69 __read_mostly cap_rights_t cap_fstat_rights; 70 __read_mostly cap_rights_t cap_fstatfs_rights; 71 __read_mostly cap_rights_t cap_fsync_rights; 72 __read_mostly cap_rights_t cap_ftruncate_rights; 73 __read_mostly cap_rights_t cap_futimes_rights; 74 __read_mostly cap_rights_t cap_getpeername_rights; 75 __read_mostly cap_rights_t cap_getsockopt_rights; 76 __read_mostly cap_rights_t cap_getsockname_rights; 77 __read_mostly cap_rights_t cap_ioctl_rights; 78 __read_mostly cap_rights_t cap_listen_rights; 79 __read_mostly cap_rights_t cap_linkat_source_rights; 80 __read_mostly cap_rights_t cap_linkat_target_rights; 81 __read_mostly cap_rights_t cap_mmap_rights; 82 __read_mostly cap_rights_t cap_mkdirat_rights; 83 __read_mostly cap_rights_t cap_mkfifoat_rights; 84 __read_mostly cap_rights_t cap_mknodat_rights; 85 __read_mostly cap_rights_t cap_pdgetpid_rights; 86 __read_mostly cap_rights_t cap_pdkill_rights; 87 __read_mostly cap_rights_t cap_pread_rights; 88 __read_mostly cap_rights_t cap_pwrite_rights; 89 __read_mostly cap_rights_t cap_read_rights; 90 __read_mostly cap_rights_t cap_recv_rights; 91 __read_mostly cap_rights_t cap_renameat_source_rights; 92 __read_mostly cap_rights_t cap_renameat_target_rights; 93 __read_mostly cap_rights_t cap_seek_rights; 94 __read_mostly cap_rights_t cap_send_rights; 95 __read_mostly cap_rights_t cap_setsockopt_rights; 96 __read_mostly cap_rights_t cap_shutdown_rights; 97 __read_mostly cap_rights_t cap_symlinkat_rights; 98 __read_mostly cap_rights_t cap_unlinkat_rights; 99 __read_mostly cap_rights_t cap_write_rights; 100 __read_mostly cap_rights_t cap_no_rights; 101 102 static void 103 __cap_rights_sysinit1(void *arg) 104 { 105 cap_rights_init(&cap_accept_rights, CAP_ACCEPT); 106 cap_rights_init(&cap_bind_rights, CAP_BIND); 107 cap_rights_init(&cap_connect_rights, CAP_CONNECT); 108 cap_rights_init(&cap_event_rights, CAP_EVENT); 109 cap_rights_init(&cap_fchdir_rights, CAP_FCHDIR); 110 cap_rights_init(&cap_fchflags_rights, CAP_FCHFLAGS); 111 cap_rights_init(&cap_fchmod_rights, CAP_FCHMOD); 112 cap_rights_init(&cap_fchown_rights, CAP_FCHOWN); 113 cap_rights_init(&cap_fcntl_rights, CAP_FCNTL); 114 cap_rights_init(&cap_fexecve_rights, CAP_FEXECVE); 115 cap_rights_init(&cap_flock_rights, CAP_FLOCK); 116 cap_rights_init(&cap_fpathconf_rights, CAP_FPATHCONF); 117 cap_rights_init(&cap_fstat_rights, CAP_FSTAT); 118 cap_rights_init(&cap_fstatfs_rights, CAP_FSTATFS); 119 cap_rights_init(&cap_fsync_rights, CAP_FSYNC); 120 cap_rights_init(&cap_ftruncate_rights, CAP_FTRUNCATE); 121 cap_rights_init(&cap_futimes_rights, CAP_FUTIMES); 122 cap_rights_init(&cap_getpeername_rights, CAP_GETPEERNAME); 123 cap_rights_init(&cap_getsockname_rights, CAP_GETSOCKNAME); 124 cap_rights_init(&cap_getsockopt_rights, CAP_GETSOCKOPT); 125 cap_rights_init(&cap_ioctl_rights, CAP_IOCTL); 126 cap_rights_init(&cap_linkat_source_rights, CAP_LINKAT_SOURCE); 127 cap_rights_init(&cap_linkat_target_rights, CAP_LINKAT_TARGET); 128 cap_rights_init(&cap_listen_rights, CAP_LISTEN); 129 cap_rights_init(&cap_mkdirat_rights, CAP_MKDIRAT); 130 cap_rights_init(&cap_mkfifoat_rights, CAP_MKFIFOAT); 131 cap_rights_init(&cap_mknodat_rights, CAP_MKNODAT); 132 cap_rights_init(&cap_mmap_rights, CAP_MMAP); 133 cap_rights_init(&cap_pdgetpid_rights, CAP_PDGETPID); 134 cap_rights_init(&cap_pdkill_rights, CAP_PDKILL); 135 cap_rights_init(&cap_pread_rights, CAP_PREAD); 136 cap_rights_init(&cap_pwrite_rights, CAP_PWRITE); 137 cap_rights_init(&cap_read_rights, CAP_READ); 138 cap_rights_init(&cap_recv_rights, CAP_RECV); 139 cap_rights_init(&cap_renameat_source_rights, CAP_RENAMEAT_SOURCE); 140 cap_rights_init(&cap_renameat_target_rights, CAP_RENAMEAT_TARGET); 141 cap_rights_init(&cap_seek_rights, CAP_SEEK); 142 cap_rights_init(&cap_send_rights, CAP_SEND); 143 cap_rights_init(&cap_setsockopt_rights, CAP_SETSOCKOPT); 144 cap_rights_init(&cap_shutdown_rights, CAP_SHUTDOWN); 145 cap_rights_init(&cap_symlinkat_rights, CAP_SYMLINKAT); 146 cap_rights_init(&cap_unlinkat_rights, CAP_UNLINKAT); 147 cap_rights_init(&cap_write_rights, CAP_WRITE); 148 cap_rights_init(&cap_no_rights); 149 } 150 SYSINIT(cap_rights1_sysinit, SI_SUB_COPYRIGHT, SI_ORDER_ANY, \ 151 __cap_rights_sysinit1, NULL); 152 153 #endif 154 155 #define CAPARSIZE_MIN (CAP_RIGHTS_VERSION_00 + 2) 156 #define CAPARSIZE_MAX (CAP_RIGHTS_VERSION + 2) 157 158 static __inline int 159 right_to_index(uint64_t right) 160 { 161 static const int bit2idx[] = { 162 -1, 0, 1, -1, 2, -1, -1, -1, 3, -1, -1, -1, -1, -1, -1, -1, 163 4, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1 164 }; 165 int idx; 166 167 idx = CAPIDXBIT(right); 168 assert(idx >= 0 && idx < sizeof(bit2idx) / sizeof(bit2idx[0])); 169 return (bit2idx[idx]); 170 } 171 172 static void 173 cap_rights_vset(cap_rights_t *rights, va_list ap) 174 { 175 uint64_t right; 176 int i, n __unused; 177 178 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 179 180 n = CAPARSIZE(rights); 181 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 182 183 for (;;) { 184 right = (uint64_t)va_arg(ap, unsigned long long); 185 if (right == 0) 186 break; 187 assert(CAPRVER(right) == 0); 188 i = right_to_index(right); 189 assert(i >= 0); 190 assert(i < n); 191 assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right)); 192 rights->cr_rights[i] |= right; 193 assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right)); 194 } 195 } 196 197 static void 198 cap_rights_vclear(cap_rights_t *rights, va_list ap) 199 { 200 uint64_t right; 201 int i, n __unused; 202 203 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 204 205 n = CAPARSIZE(rights); 206 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 207 208 for (;;) { 209 right = (uint64_t)va_arg(ap, unsigned long long); 210 if (right == 0) 211 break; 212 assert(CAPRVER(right) == 0); 213 i = right_to_index(right); 214 assert(i >= 0); 215 assert(i < n); 216 assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right)); 217 rights->cr_rights[i] &= ~(right & 0x01FFFFFFFFFFFFFFULL); 218 assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right)); 219 } 220 } 221 222 static bool 223 cap_rights_is_vset(const cap_rights_t *rights, va_list ap) 224 { 225 uint64_t right; 226 int i, n __unused; 227 228 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 229 230 n = CAPARSIZE(rights); 231 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 232 233 for (;;) { 234 right = (uint64_t)va_arg(ap, unsigned long long); 235 if (right == 0) 236 break; 237 assert(CAPRVER(right) == 0); 238 i = right_to_index(right); 239 assert(i >= 0); 240 assert(i < n); 241 assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right)); 242 if ((rights->cr_rights[i] & right) != right) 243 return (false); 244 } 245 246 return (true); 247 } 248 249 void 250 __cap_rights_sysinit(void *arg) 251 { 252 struct cap_rights_init_args *cria = arg; 253 cap_rights_t *rights = cria->cria_rights; 254 255 __cap_rights_init(CAP_RIGHTS_VERSION, rights, cria->cria_value1, 256 cria->cria_value2, cria->cria_value3, cria->cria_value4, 0ULL); 257 } 258 259 cap_rights_t * 260 __cap_rights_init(int version, cap_rights_t *rights, ...) 261 { 262 unsigned int n __unused; 263 va_list ap; 264 265 assert(version == CAP_RIGHTS_VERSION_00); 266 267 n = version + 2; 268 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 269 CAP_NONE(rights); 270 va_start(ap, rights); 271 cap_rights_vset(rights, ap); 272 va_end(ap); 273 274 return (rights); 275 } 276 277 cap_rights_t * 278 __cap_rights_set(cap_rights_t *rights, ...) 279 { 280 va_list ap; 281 282 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 283 284 va_start(ap, rights); 285 cap_rights_vset(rights, ap); 286 va_end(ap); 287 288 return (rights); 289 } 290 291 cap_rights_t * 292 __cap_rights_clear(cap_rights_t *rights, ...) 293 { 294 va_list ap; 295 296 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 297 298 va_start(ap, rights); 299 cap_rights_vclear(rights, ap); 300 va_end(ap); 301 302 return (rights); 303 } 304 305 bool 306 __cap_rights_is_set(const cap_rights_t *rights, ...) 307 { 308 va_list ap; 309 bool ret; 310 311 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 312 313 va_start(ap, rights); 314 ret = cap_rights_is_vset(rights, ap); 315 va_end(ap); 316 317 return (ret); 318 } 319 320 bool 321 cap_rights_is_valid(const cap_rights_t *rights) 322 { 323 cap_rights_t allrights; 324 int i, j; 325 326 if (CAPVER(rights) != CAP_RIGHTS_VERSION_00) 327 return (false); 328 if (CAPARSIZE(rights) < CAPARSIZE_MIN || 329 CAPARSIZE(rights) > CAPARSIZE_MAX) { 330 return (false); 331 } 332 CAP_ALL(&allrights); 333 if (!cap_rights_contains(&allrights, rights)) 334 return (false); 335 for (i = 0; i < CAPARSIZE(rights); i++) { 336 j = right_to_index(rights->cr_rights[i]); 337 if (i != j) 338 return (false); 339 if (i > 0) { 340 if (CAPRVER(rights->cr_rights[i]) != 0) 341 return (false); 342 } 343 } 344 345 return (true); 346 } 347 348 cap_rights_t * 349 cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src) 350 { 351 unsigned int i, n; 352 353 assert(CAPVER(dst) == CAP_RIGHTS_VERSION_00); 354 assert(CAPVER(src) == CAP_RIGHTS_VERSION_00); 355 assert(CAPVER(dst) == CAPVER(src)); 356 assert(cap_rights_is_valid(src)); 357 assert(cap_rights_is_valid(dst)); 358 359 n = CAPARSIZE(dst); 360 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 361 362 for (i = 0; i < n; i++) 363 dst->cr_rights[i] |= src->cr_rights[i]; 364 365 assert(cap_rights_is_valid(src)); 366 assert(cap_rights_is_valid(dst)); 367 368 return (dst); 369 } 370 371 cap_rights_t * 372 cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src) 373 { 374 unsigned int i, n; 375 376 assert(CAPVER(dst) == CAP_RIGHTS_VERSION_00); 377 assert(CAPVER(src) == CAP_RIGHTS_VERSION_00); 378 assert(CAPVER(dst) == CAPVER(src)); 379 assert(cap_rights_is_valid(src)); 380 assert(cap_rights_is_valid(dst)); 381 382 n = CAPARSIZE(dst); 383 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 384 385 for (i = 0; i < n; i++) { 386 dst->cr_rights[i] &= 387 ~(src->cr_rights[i] & 0x01FFFFFFFFFFFFFFULL); 388 } 389 390 assert(cap_rights_is_valid(src)); 391 assert(cap_rights_is_valid(dst)); 392 393 return (dst); 394 } 395 396 bool 397 cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little) 398 { 399 unsigned int i, n; 400 401 assert(CAPVER(big) == CAP_RIGHTS_VERSION_00); 402 assert(CAPVER(little) == CAP_RIGHTS_VERSION_00); 403 assert(CAPVER(big) == CAPVER(little)); 404 405 n = CAPARSIZE(big); 406 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 407 408 for (i = 0; i < n; i++) { 409 if ((big->cr_rights[i] & little->cr_rights[i]) != 410 little->cr_rights[i]) { 411 return (false); 412 } 413 } 414 415 return (true); 416 } 417