xref: /freebsd/sys/kern/sys_capability.c (revision 2b15cb3d0922bd70ea592f0da9b4a5b167f4d53f) 
1 /*-
2  * Copyright (c) 2008-2011 Robert N. M. Watson
3  * Copyright (c) 2010-2011 Jonathan Anderson
4  * Copyright (c) 2012 FreeBSD Foundation
5  * All rights reserved.
6  *
7  * This software was developed at the University of Cambridge Computer
8  * Laboratory with support from a grant from Google, Inc.
9  *
10  * Portions of this software were developed by Pawel Jakub Dawidek under
11  * sponsorship from the FreeBSD Foundation.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  */
34 
35 /*
36  * FreeBSD kernel capability facility.
37  *
38  * Two kernel features are implemented here: capability mode, a sandboxed mode
39  * of execution for processes, and capabilities, a refinement on file
40  * descriptors that allows fine-grained control over operations on the file
41  * descriptor.  Collectively, these allow processes to run in the style of a
42  * historic "capability system" in which they can use only resources
43  * explicitly delegated to them.  This model is enforced by restricting access
44  * to global namespaces in capability mode.
45  *
46  * Capabilities wrap other file descriptor types, binding them to a constant
47  * rights mask set when the capability is created.  New capabilities may be
48  * derived from existing capabilities, but only if they have the same or a
49  * strict subset of the rights on the original capability.
50  *
51  * System calls permitted in capability mode are defined in capabilities.conf;
52  * calls must be carefully audited for safety to ensure that they don't allow
53  * escape from a sandbox.  Some calls permit only a subset of operations in
54  * capability mode -- for example, shm_open(2) is limited to creating
55  * anonymous, rather than named, POSIX shared memory objects.
56  */
57 
58 #include <sys/cdefs.h>
59 __FBSDID("$FreeBSD$");
60 
61 #include "opt_capsicum.h"
62 #include "opt_ktrace.h"
63 
64 #include <sys/param.h>
65 #include <sys/capsicum.h>
66 #include <sys/file.h>
67 #include <sys/filedesc.h>
68 #include <sys/kernel.h>
69 #include <sys/limits.h>
70 #include <sys/lock.h>
71 #include <sys/mutex.h>
72 #include <sys/proc.h>
73 #include <sys/syscallsubr.h>
74 #include <sys/sysproto.h>
75 #include <sys/sysctl.h>
76 #include <sys/systm.h>
77 #include <sys/ucred.h>
78 #include <sys/uio.h>
79 #include <sys/ktrace.h>
80 
81 #include <security/audit/audit.h>
82 
83 #include <vm/uma.h>
84 #include <vm/vm.h>
85 
86 #ifdef CAPABILITY_MODE
87 
88 FEATURE(security_capability_mode, "Capsicum Capability Mode");
89 
90 /*
91  * System call to enter capability mode for the process.
92  */
93 int
94 sys_cap_enter(struct thread *td, struct cap_enter_args *uap)
95 {
96 	struct ucred *newcred, *oldcred;
97 	struct proc *p;
98 
99 	if (IN_CAPABILITY_MODE(td))
100 		return (0);
101 
102 	newcred = crget();
103 	p = td->td_proc;
104 	PROC_LOCK(p);
105 	oldcred = crcopysafe(p, newcred);
106 	newcred->cr_flags |= CRED_FLAG_CAPMODE;
107 	proc_set_cred(p, newcred);
108 	PROC_UNLOCK(p);
109 	crfree(oldcred);
110 	return (0);
111 }
112 
113 /*
114  * System call to query whether the process is in capability mode.
115  */
116 int
117 sys_cap_getmode(struct thread *td, struct cap_getmode_args *uap)
118 {
119 	u_int i;
120 
121 	i = IN_CAPABILITY_MODE(td) ? 1 : 0;
122 	return (copyout(&i, uap->modep, sizeof(i)));
123 }
124 
125 #else /* !CAPABILITY_MODE */
126 
127 int
128 sys_cap_enter(struct thread *td, struct cap_enter_args *uap)
129 {
130 
131 	return (ENOSYS);
132 }
133 
134 int
135 sys_cap_getmode(struct thread *td, struct cap_getmode_args *uap)
136 {
137 
138 	return (ENOSYS);
139 }
140 
141 #endif /* CAPABILITY_MODE */
142 
143 #ifdef CAPABILITIES
144 
145 FEATURE(security_capabilities, "Capsicum Capabilities");
146 
147 MALLOC_DECLARE(M_FILECAPS);
148 
149 static inline int
150 _cap_check(const cap_rights_t *havep, const cap_rights_t *needp,
151     enum ktr_cap_fail_type type)
152 {
153 	int i;
154 
155 	for (i = 0; i < nitems(havep->cr_rights); i++) {
156 		if (!cap_rights_contains(havep, needp)) {
157 #ifdef KTRACE
158 			if (KTRPOINT(curthread, KTR_CAPFAIL))
159 				ktrcapfail(type, needp, havep);
160 #endif
161 			return (ENOTCAPABLE);
162 		}
163 	}
164 	return (0);
165 }
166 
167 /*
168  * Test whether a capability grants the requested rights.
169  */
170 int
171 cap_check(const cap_rights_t *havep, const cap_rights_t *needp)
172 {
173 
174 	return (_cap_check(havep, needp, CAPFAIL_NOTCAPABLE));
175 }
176 
177 /*
178  * Convert capability rights into VM access flags.
179  */
180 u_char
181 cap_rights_to_vmprot(cap_rights_t *havep)
182 {
183 	u_char maxprot;
184 
185 	maxprot = VM_PROT_NONE;
186 	if (cap_rights_is_set(havep, CAP_MMAP_R))
187 		maxprot |= VM_PROT_READ;
188 	if (cap_rights_is_set(havep, CAP_MMAP_W))
189 		maxprot |= VM_PROT_WRITE;
190 	if (cap_rights_is_set(havep, CAP_MMAP_X))
191 		maxprot |= VM_PROT_EXECUTE;
192 
193 	return (maxprot);
194 }
195 
196 /*
197  * Extract rights from a capability for monitoring purposes -- not for use in
198  * any other way, as we want to keep all capability permission evaluation in
199  * this one file.
200  */
201 
202 cap_rights_t *
203 cap_rights_fde(struct filedescent *fde)
204 {
205 
206 	return (&fde->fde_rights);
207 }
208 
209 cap_rights_t *
210 cap_rights(struct filedesc *fdp, int fd)
211 {
212 
213 	return (cap_rights_fde(&fdp->fd_ofiles[fd]));
214 }
215 
216 /*
217  * System call to limit rights of the given capability.
218  */
219 int
220 sys_cap_rights_limit(struct thread *td, struct cap_rights_limit_args *uap)
221 {
222 	struct filedesc *fdp;
223 	cap_rights_t rights;
224 	int error, fd, version;
225 
226 	cap_rights_init(&rights);
227 
228 	error = copyin(uap->rightsp, &rights, sizeof(rights.cr_rights[0]));
229 	if (error != 0)
230 		return (error);
231 	version = CAPVER(&rights);
232 	if (version != CAP_RIGHTS_VERSION_00)
233 		return (EINVAL);
234 
235 	error = copyin(uap->rightsp, &rights,
236 	    sizeof(rights.cr_rights[0]) * CAPARSIZE(&rights));
237 	if (error != 0)
238 		return (error);
239 	/* Check for race. */
240 	if (CAPVER(&rights) != version)
241 		return (EINVAL);
242 
243 	if (!cap_rights_is_valid(&rights))
244 		return (EINVAL);
245 
246 	if (version != CAP_RIGHTS_VERSION) {
247 		rights.cr_rights[0] &= ~(0x3ULL << 62);
248 		rights.cr_rights[0] |= ((uint64_t)CAP_RIGHTS_VERSION << 62);
249 	}
250 #ifdef KTRACE
251 	if (KTRPOINT(td, KTR_STRUCT))
252 		ktrcaprights(&rights);
253 #endif
254 
255 	fd = uap->fd;
256 
257 	AUDIT_ARG_FD(fd);
258 	AUDIT_ARG_RIGHTS(&rights);
259 
260 	fdp = td->td_proc->p_fd;
261 	FILEDESC_XLOCK(fdp);
262 	if (fget_locked(fdp, fd) == NULL) {
263 		FILEDESC_XUNLOCK(fdp);
264 		return (EBADF);
265 	}
266 	error = _cap_check(cap_rights(fdp, fd), &rights, CAPFAIL_INCREASE);
267 	if (error == 0) {
268 		fdp->fd_ofiles[fd].fde_rights = rights;
269 		if (!cap_rights_is_set(&rights, CAP_IOCTL)) {
270 			free(fdp->fd_ofiles[fd].fde_ioctls, M_FILECAPS);
271 			fdp->fd_ofiles[fd].fde_ioctls = NULL;
272 			fdp->fd_ofiles[fd].fde_nioctls = 0;
273 		}
274 		if (!cap_rights_is_set(&rights, CAP_FCNTL))
275 			fdp->fd_ofiles[fd].fde_fcntls = 0;
276 	}
277 	FILEDESC_XUNLOCK(fdp);
278 	return (error);
279 }
280 
281 /*
282  * System call to query the rights mask associated with a capability.
283  */
284 int
285 sys___cap_rights_get(struct thread *td, struct __cap_rights_get_args *uap)
286 {
287 	struct filedesc *fdp;
288 	cap_rights_t rights;
289 	int error, fd, i, n;
290 
291 	if (uap->version != CAP_RIGHTS_VERSION_00)
292 		return (EINVAL);
293 
294 	fd = uap->fd;
295 
296 	AUDIT_ARG_FD(fd);
297 
298 	fdp = td->td_proc->p_fd;
299 	FILEDESC_SLOCK(fdp);
300 	if (fget_locked(fdp, fd) == NULL) {
301 		FILEDESC_SUNLOCK(fdp);
302 		return (EBADF);
303 	}
304 	rights = *cap_rights(fdp, fd);
305 	FILEDESC_SUNLOCK(fdp);
306 	n = uap->version + 2;
307 	if (uap->version != CAPVER(&rights)) {
308 		/*
309 		 * For older versions we need to check if the descriptor
310 		 * doesn't contain rights not understood by the caller.
311 		 * If it does, we have to return an error.
312 		 */
313 		for (i = n; i < CAPARSIZE(&rights); i++) {
314 			if ((rights.cr_rights[i] & ~(0x7FULL << 57)) != 0)
315 				return (EINVAL);
316 		}
317 	}
318 	error = copyout(&rights, uap->rightsp, sizeof(rights.cr_rights[0]) * n);
319 #ifdef KTRACE
320 	if (error == 0 && KTRPOINT(td, KTR_STRUCT))
321 		ktrcaprights(&rights);
322 #endif
323 	return (error);
324 }
325 
326 /*
327  * Test whether a capability grants the given ioctl command.
328  * If descriptor doesn't have CAP_IOCTL, then ioctls list is empty and
329  * ENOTCAPABLE will be returned.
330  */
331 int
332 cap_ioctl_check(struct filedesc *fdp, int fd, u_long cmd)
333 {
334 	u_long *cmds;
335 	ssize_t ncmds;
336 	long i;
337 
338 	FILEDESC_LOCK_ASSERT(fdp);
339 	KASSERT(fd >= 0 && fd < fdp->fd_nfiles,
340 	    ("%s: invalid fd=%d", __func__, fd));
341 
342 	ncmds = fdp->fd_ofiles[fd].fde_nioctls;
343 	if (ncmds == -1)
344 		return (0);
345 
346 	cmds = fdp->fd_ofiles[fd].fde_ioctls;
347 	for (i = 0; i < ncmds; i++) {
348 		if (cmds[i] == cmd)
349 			return (0);
350 	}
351 
352 	return (ENOTCAPABLE);
353 }
354 
355 /*
356  * Check if the current ioctls list can be replaced by the new one.
357  */
358 static int
359 cap_ioctl_limit_check(struct filedesc *fdp, int fd, const u_long *cmds,
360     size_t ncmds)
361 {
362 	u_long *ocmds;
363 	ssize_t oncmds;
364 	u_long i;
365 	long j;
366 
367 	oncmds = fdp->fd_ofiles[fd].fde_nioctls;
368 	if (oncmds == -1)
369 		return (0);
370 	if (oncmds < (ssize_t)ncmds)
371 		return (ENOTCAPABLE);
372 
373 	ocmds = fdp->fd_ofiles[fd].fde_ioctls;
374 	for (i = 0; i < ncmds; i++) {
375 		for (j = 0; j < oncmds; j++) {
376 			if (cmds[i] == ocmds[j])
377 				break;
378 		}
379 		if (j == oncmds)
380 			return (ENOTCAPABLE);
381 	}
382 
383 	return (0);
384 }
385 
386 int
387 kern_cap_ioctls_limit(struct thread *td, int fd, u_long *cmds, size_t ncmds)
388 {
389 	struct filedesc *fdp;
390 	u_long *ocmds;
391 	int error;
392 
393 	AUDIT_ARG_FD(fd);
394 
395 	fdp = td->td_proc->p_fd;
396 	FILEDESC_XLOCK(fdp);
397 
398 	if (fget_locked(fdp, fd) == NULL) {
399 		error = EBADF;
400 		goto out;
401 	}
402 
403 	error = cap_ioctl_limit_check(fdp, fd, cmds, ncmds);
404 	if (error != 0)
405 		goto out;
406 
407 	ocmds = fdp->fd_ofiles[fd].fde_ioctls;
408 	fdp->fd_ofiles[fd].fde_ioctls = cmds;
409 	fdp->fd_ofiles[fd].fde_nioctls = ncmds;
410 
411 	cmds = ocmds;
412 	error = 0;
413 out:
414 	FILEDESC_XUNLOCK(fdp);
415 	free(cmds, M_FILECAPS);
416 	return (error);
417 }
418 
419 int
420 sys_cap_ioctls_limit(struct thread *td, struct cap_ioctls_limit_args *uap)
421 {
422 	u_long *cmds;
423 	size_t ncmds;
424 	int error;
425 
426 	ncmds = uap->ncmds;
427 
428 	if (ncmds > 256)	/* XXX: Is 256 sane? */
429 		return (EINVAL);
430 
431 	if (ncmds == 0) {
432 		cmds = NULL;
433 	} else {
434 		cmds = malloc(sizeof(cmds[0]) * ncmds, M_FILECAPS, M_WAITOK);
435 		error = copyin(uap->cmds, cmds, sizeof(cmds[0]) * ncmds);
436 		if (error != 0) {
437 			free(cmds, M_FILECAPS);
438 			return (error);
439 		}
440 	}
441 
442 	return (kern_cap_ioctls_limit(td, uap->fd, cmds, ncmds));
443 }
444 
445 int
446 sys_cap_ioctls_get(struct thread *td, struct cap_ioctls_get_args *uap)
447 {
448 	struct filedesc *fdp;
449 	struct filedescent *fdep;
450 	u_long *cmds;
451 	size_t maxcmds;
452 	int error, fd;
453 
454 	fd = uap->fd;
455 	cmds = uap->cmds;
456 	maxcmds = uap->maxcmds;
457 
458 	AUDIT_ARG_FD(fd);
459 
460 	fdp = td->td_proc->p_fd;
461 	FILEDESC_SLOCK(fdp);
462 
463 	if (fget_locked(fdp, fd) == NULL) {
464 		error = EBADF;
465 		goto out;
466 	}
467 
468 	/*
469 	 * If all ioctls are allowed (fde_nioctls == -1 && fde_ioctls == NULL)
470 	 * the only sane thing we can do is to not populate the given array and
471 	 * return CAP_IOCTLS_ALL.
472 	 */
473 
474 	fdep = &fdp->fd_ofiles[fd];
475 	if (cmds != NULL && fdep->fde_ioctls != NULL) {
476 		error = copyout(fdep->fde_ioctls, cmds,
477 		    sizeof(cmds[0]) * MIN(fdep->fde_nioctls, maxcmds));
478 		if (error != 0)
479 			goto out;
480 	}
481 	if (fdep->fde_nioctls == -1)
482 		td->td_retval[0] = CAP_IOCTLS_ALL;
483 	else
484 		td->td_retval[0] = fdep->fde_nioctls;
485 
486 	error = 0;
487 out:
488 	FILEDESC_SUNLOCK(fdp);
489 	return (error);
490 }
491 
492 /*
493  * Test whether a capability grants the given fcntl command.
494  */
495 int
496 cap_fcntl_check_fde(struct filedescent *fde, int cmd)
497 {
498 	uint32_t fcntlcap;
499 
500 	fcntlcap = (1 << cmd);
501 	KASSERT((CAP_FCNTL_ALL & fcntlcap) != 0,
502 	    ("Unsupported fcntl=%d.", cmd));
503 
504 	if ((fde->fde_fcntls & fcntlcap) != 0)
505 		return (0);
506 
507 	return (ENOTCAPABLE);
508 }
509 
510 int
511 cap_fcntl_check(struct filedesc *fdp, int fd, int cmd)
512 {
513 
514 	KASSERT(fd >= 0 && fd < fdp->fd_nfiles,
515 	    ("%s: invalid fd=%d", __func__, fd));
516 
517 	return (cap_fcntl_check_fde(&fdp->fd_ofiles[fd], cmd));
518 }
519 
520 int
521 sys_cap_fcntls_limit(struct thread *td, struct cap_fcntls_limit_args *uap)
522 {
523 	struct filedesc *fdp;
524 	uint32_t fcntlrights;
525 	int fd;
526 
527 	fd = uap->fd;
528 	fcntlrights = uap->fcntlrights;
529 
530 	AUDIT_ARG_FD(fd);
531 	AUDIT_ARG_FCNTL_RIGHTS(fcntlrights);
532 
533 	if ((fcntlrights & ~CAP_FCNTL_ALL) != 0)
534 		return (EINVAL);
535 
536 	fdp = td->td_proc->p_fd;
537 	FILEDESC_XLOCK(fdp);
538 
539 	if (fget_locked(fdp, fd) == NULL) {
540 		FILEDESC_XUNLOCK(fdp);
541 		return (EBADF);
542 	}
543 
544 	if ((fcntlrights & ~fdp->fd_ofiles[fd].fde_fcntls) != 0) {
545 		FILEDESC_XUNLOCK(fdp);
546 		return (ENOTCAPABLE);
547 	}
548 
549 	fdp->fd_ofiles[fd].fde_fcntls = fcntlrights;
550 	FILEDESC_XUNLOCK(fdp);
551 
552 	return (0);
553 }
554 
555 int
556 sys_cap_fcntls_get(struct thread *td, struct cap_fcntls_get_args *uap)
557 {
558 	struct filedesc *fdp;
559 	uint32_t rights;
560 	int fd;
561 
562 	fd = uap->fd;
563 
564 	AUDIT_ARG_FD(fd);
565 
566 	fdp = td->td_proc->p_fd;
567 	FILEDESC_SLOCK(fdp);
568 	if (fget_locked(fdp, fd) == NULL) {
569 		FILEDESC_SUNLOCK(fdp);
570 		return (EBADF);
571 	}
572 	rights = fdp->fd_ofiles[fd].fde_fcntls;
573 	FILEDESC_SUNLOCK(fdp);
574 
575 	return (copyout(&rights, uap->fcntlrightsp, sizeof(rights)));
576 }
577 
578 #else /* !CAPABILITIES */
579 
580 /*
581  * Stub Capability functions for when options CAPABILITIES isn't compiled
582  * into the kernel.
583  */
584 
585 int
586 sys_cap_rights_limit(struct thread *td, struct cap_rights_limit_args *uap)
587 {
588 
589 	return (ENOSYS);
590 }
591 
592 int
593 sys___cap_rights_get(struct thread *td, struct __cap_rights_get_args *uap)
594 {
595 
596 	return (ENOSYS);
597 }
598 
599 int
600 sys_cap_ioctls_limit(struct thread *td, struct cap_ioctls_limit_args *uap)
601 {
602 
603 	return (ENOSYS);
604 }
605 
606 int
607 sys_cap_ioctls_get(struct thread *td, struct cap_ioctls_get_args *uap)
608 {
609 
610 	return (ENOSYS);
611 }
612 
613 int
614 sys_cap_fcntls_limit(struct thread *td, struct cap_fcntls_limit_args *uap)
615 {
616 
617 	return (ENOSYS);
618 }
619 
620 int
621 sys_cap_fcntls_get(struct thread *td, struct cap_fcntls_get_args *uap)
622 {
623 
624 	return (ENOSYS);
625 }
626 
627 #endif /* CAPABILITIES */
628