1 /*- 2 * Copyright (c) 2008-2011 Robert N. M. Watson 3 * Copyright (c) 2010-2011 Jonathan Anderson 4 * Copyright (c) 2012 FreeBSD Foundation 5 * All rights reserved. 6 * 7 * This software was developed at the University of Cambridge Computer 8 * Laboratory with support from a grant from Google, Inc. 9 * 10 * Portions of this software were developed by Pawel Jakub Dawidek under 11 * sponsorship from the FreeBSD Foundation. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 */ 34 35 /* 36 * FreeBSD kernel capability facility. 37 * 38 * Two kernel features are implemented here: capability mode, a sandboxed mode 39 * of execution for processes, and capabilities, a refinement on file 40 * descriptors that allows fine-grained control over operations on the file 41 * descriptor. Collectively, these allow processes to run in the style of a 42 * historic "capability system" in which they can use only resources 43 * explicitly delegated to them. This model is enforced by restricting access 44 * to global namespaces in capability mode. 45 * 46 * Capabilities wrap other file descriptor types, binding them to a constant 47 * rights mask set when the capability is created. New capabilities may be 48 * derived from existing capabilities, but only if they have the same or a 49 * strict subset of the rights on the original capability. 50 * 51 * System calls permitted in capability mode are defined in capabilities.conf; 52 * calls must be carefully audited for safety to ensure that they don't allow 53 * escape from a sandbox. Some calls permit only a subset of operations in 54 * capability mode -- for example, shm_open(2) is limited to creating 55 * anonymous, rather than named, POSIX shared memory objects. 56 */ 57 58 #include <sys/cdefs.h> 59 __FBSDID("$FreeBSD$"); 60 61 #include "opt_capsicum.h" 62 #include "opt_ktrace.h" 63 64 #include <sys/param.h> 65 #include <sys/capsicum.h> 66 #include <sys/file.h> 67 #include <sys/filedesc.h> 68 #include <sys/kernel.h> 69 #include <sys/limits.h> 70 #include <sys/lock.h> 71 #include <sys/mutex.h> 72 #include <sys/proc.h> 73 #include <sys/syscallsubr.h> 74 #include <sys/sysproto.h> 75 #include <sys/sysctl.h> 76 #include <sys/systm.h> 77 #include <sys/ucred.h> 78 #include <sys/uio.h> 79 #include <sys/ktrace.h> 80 81 #include <security/audit/audit.h> 82 83 #include <vm/uma.h> 84 #include <vm/vm.h> 85 86 int trap_enotcap; 87 SYSCTL_INT(_kern, OID_AUTO, trap_enotcap, CTLFLAG_RW, &trap_enotcap, 0, 88 "Deliver SIGTRAP on ENOTCAPABLE"); 89 90 #ifdef CAPABILITY_MODE 91 92 #define IOCTLS_MAX_COUNT 256 /* XXX: Is 256 sane? */ 93 94 FEATURE(security_capability_mode, "Capsicum Capability Mode"); 95 96 /* 97 * System call to enter capability mode for the process. 98 */ 99 int 100 sys_cap_enter(struct thread *td, struct cap_enter_args *uap) 101 { 102 struct ucred *newcred, *oldcred; 103 struct proc *p; 104 105 if (IN_CAPABILITY_MODE(td)) 106 return (0); 107 108 newcred = crget(); 109 p = td->td_proc; 110 PROC_LOCK(p); 111 oldcred = crcopysafe(p, newcred); 112 newcred->cr_flags |= CRED_FLAG_CAPMODE; 113 proc_set_cred(p, newcred); 114 PROC_UNLOCK(p); 115 crfree(oldcred); 116 return (0); 117 } 118 119 /* 120 * System call to query whether the process is in capability mode. 121 */ 122 int 123 sys_cap_getmode(struct thread *td, struct cap_getmode_args *uap) 124 { 125 u_int i; 126 127 i = IN_CAPABILITY_MODE(td) ? 1 : 0; 128 return (copyout(&i, uap->modep, sizeof(i))); 129 } 130 131 #else /* !CAPABILITY_MODE */ 132 133 int 134 sys_cap_enter(struct thread *td, struct cap_enter_args *uap) 135 { 136 137 return (ENOSYS); 138 } 139 140 int 141 sys_cap_getmode(struct thread *td, struct cap_getmode_args *uap) 142 { 143 144 return (ENOSYS); 145 } 146 147 #endif /* CAPABILITY_MODE */ 148 149 #ifdef CAPABILITIES 150 151 FEATURE(security_capabilities, "Capsicum Capabilities"); 152 153 MALLOC_DECLARE(M_FILECAPS); 154 155 static inline int 156 _cap_check(const cap_rights_t *havep, const cap_rights_t *needp, 157 enum ktr_cap_fail_type type) 158 { 159 160 if (!cap_rights_contains(havep, needp)) { 161 #ifdef KTRACE 162 if (KTRPOINT(curthread, KTR_CAPFAIL)) 163 ktrcapfail(type, needp, havep); 164 #endif 165 return (ENOTCAPABLE); 166 } 167 return (0); 168 } 169 170 /* 171 * Test whether a capability grants the requested rights. 172 */ 173 int 174 cap_check(const cap_rights_t *havep, const cap_rights_t *needp) 175 { 176 177 return (_cap_check(havep, needp, CAPFAIL_NOTCAPABLE)); 178 } 179 180 /* 181 * Convert capability rights into VM access flags. 182 */ 183 u_char 184 cap_rights_to_vmprot(cap_rights_t *havep) 185 { 186 u_char maxprot; 187 188 maxprot = VM_PROT_NONE; 189 if (cap_rights_is_set(havep, CAP_MMAP_R)) 190 maxprot |= VM_PROT_READ; 191 if (cap_rights_is_set(havep, CAP_MMAP_W)) 192 maxprot |= VM_PROT_WRITE; 193 if (cap_rights_is_set(havep, CAP_MMAP_X)) 194 maxprot |= VM_PROT_EXECUTE; 195 196 return (maxprot); 197 } 198 199 /* 200 * Extract rights from a capability for monitoring purposes -- not for use in 201 * any other way, as we want to keep all capability permission evaluation in 202 * this one file. 203 */ 204 205 cap_rights_t * 206 cap_rights_fde(struct filedescent *fde) 207 { 208 209 return (&fde->fde_rights); 210 } 211 212 cap_rights_t * 213 cap_rights(struct filedesc *fdp, int fd) 214 { 215 216 return (cap_rights_fde(&fdp->fd_ofiles[fd])); 217 } 218 219 int 220 kern_cap_rights_limit(struct thread *td, int fd, cap_rights_t *rights) 221 { 222 struct filedesc *fdp; 223 int error; 224 225 fdp = td->td_proc->p_fd; 226 FILEDESC_XLOCK(fdp); 227 if (fget_locked(fdp, fd) == NULL) { 228 FILEDESC_XUNLOCK(fdp); 229 return (EBADF); 230 } 231 error = _cap_check(cap_rights(fdp, fd), rights, CAPFAIL_INCREASE); 232 if (error == 0) { 233 fdp->fd_ofiles[fd].fde_rights = *rights; 234 if (!cap_rights_is_set(rights, CAP_IOCTL)) { 235 free(fdp->fd_ofiles[fd].fde_ioctls, M_FILECAPS); 236 fdp->fd_ofiles[fd].fde_ioctls = NULL; 237 fdp->fd_ofiles[fd].fde_nioctls = 0; 238 } 239 if (!cap_rights_is_set(rights, CAP_FCNTL)) 240 fdp->fd_ofiles[fd].fde_fcntls = 0; 241 } 242 FILEDESC_XUNLOCK(fdp); 243 return (error); 244 } 245 246 /* 247 * System call to limit rights of the given capability. 248 */ 249 int 250 sys_cap_rights_limit(struct thread *td, struct cap_rights_limit_args *uap) 251 { 252 cap_rights_t rights; 253 int error, version; 254 255 cap_rights_init(&rights); 256 257 error = copyin(uap->rightsp, &rights, sizeof(rights.cr_rights[0])); 258 if (error != 0) 259 return (error); 260 version = CAPVER(&rights); 261 if (version != CAP_RIGHTS_VERSION_00) 262 return (EINVAL); 263 264 error = copyin(uap->rightsp, &rights, 265 sizeof(rights.cr_rights[0]) * CAPARSIZE(&rights)); 266 if (error != 0) 267 return (error); 268 /* Check for race. */ 269 if (CAPVER(&rights) != version) 270 return (EINVAL); 271 272 if (!cap_rights_is_valid(&rights)) 273 return (EINVAL); 274 275 if (version != CAP_RIGHTS_VERSION) { 276 rights.cr_rights[0] &= ~(0x3ULL << 62); 277 rights.cr_rights[0] |= ((uint64_t)CAP_RIGHTS_VERSION << 62); 278 } 279 #ifdef KTRACE 280 if (KTRPOINT(td, KTR_STRUCT)) 281 ktrcaprights(&rights); 282 #endif 283 284 AUDIT_ARG_FD(uap->fd); 285 AUDIT_ARG_RIGHTS(&rights); 286 return (kern_cap_rights_limit(td, uap->fd, &rights)); 287 } 288 289 /* 290 * System call to query the rights mask associated with a capability. 291 */ 292 int 293 sys___cap_rights_get(struct thread *td, struct __cap_rights_get_args *uap) 294 { 295 struct filedesc *fdp; 296 cap_rights_t rights; 297 int error, fd, i, n; 298 299 if (uap->version != CAP_RIGHTS_VERSION_00) 300 return (EINVAL); 301 302 fd = uap->fd; 303 304 AUDIT_ARG_FD(fd); 305 306 fdp = td->td_proc->p_fd; 307 FILEDESC_SLOCK(fdp); 308 if (fget_locked(fdp, fd) == NULL) { 309 FILEDESC_SUNLOCK(fdp); 310 return (EBADF); 311 } 312 rights = *cap_rights(fdp, fd); 313 FILEDESC_SUNLOCK(fdp); 314 n = uap->version + 2; 315 if (uap->version != CAPVER(&rights)) { 316 /* 317 * For older versions we need to check if the descriptor 318 * doesn't contain rights not understood by the caller. 319 * If it does, we have to return an error. 320 */ 321 for (i = n; i < CAPARSIZE(&rights); i++) { 322 if ((rights.cr_rights[i] & ~(0x7FULL << 57)) != 0) 323 return (EINVAL); 324 } 325 } 326 error = copyout(&rights, uap->rightsp, sizeof(rights.cr_rights[0]) * n); 327 #ifdef KTRACE 328 if (error == 0 && KTRPOINT(td, KTR_STRUCT)) 329 ktrcaprights(&rights); 330 #endif 331 return (error); 332 } 333 334 /* 335 * Test whether a capability grants the given ioctl command. 336 * If descriptor doesn't have CAP_IOCTL, then ioctls list is empty and 337 * ENOTCAPABLE will be returned. 338 */ 339 int 340 cap_ioctl_check(struct filedesc *fdp, int fd, u_long cmd) 341 { 342 u_long *cmds; 343 ssize_t ncmds; 344 long i; 345 346 FILEDESC_LOCK_ASSERT(fdp); 347 KASSERT(fd >= 0 && fd < fdp->fd_nfiles, 348 ("%s: invalid fd=%d", __func__, fd)); 349 350 ncmds = fdp->fd_ofiles[fd].fde_nioctls; 351 if (ncmds == -1) 352 return (0); 353 354 cmds = fdp->fd_ofiles[fd].fde_ioctls; 355 for (i = 0; i < ncmds; i++) { 356 if (cmds[i] == cmd) 357 return (0); 358 } 359 360 return (ENOTCAPABLE); 361 } 362 363 /* 364 * Check if the current ioctls list can be replaced by the new one. 365 */ 366 static int 367 cap_ioctl_limit_check(struct filedesc *fdp, int fd, const u_long *cmds, 368 size_t ncmds) 369 { 370 u_long *ocmds; 371 ssize_t oncmds; 372 u_long i; 373 long j; 374 375 oncmds = fdp->fd_ofiles[fd].fde_nioctls; 376 if (oncmds == -1) 377 return (0); 378 if (oncmds < (ssize_t)ncmds) 379 return (ENOTCAPABLE); 380 381 ocmds = fdp->fd_ofiles[fd].fde_ioctls; 382 for (i = 0; i < ncmds; i++) { 383 for (j = 0; j < oncmds; j++) { 384 if (cmds[i] == ocmds[j]) 385 break; 386 } 387 if (j == oncmds) 388 return (ENOTCAPABLE); 389 } 390 391 return (0); 392 } 393 394 int 395 kern_cap_ioctls_limit(struct thread *td, int fd, u_long *cmds, size_t ncmds) 396 { 397 struct filedesc *fdp; 398 u_long *ocmds; 399 int error; 400 401 AUDIT_ARG_FD(fd); 402 403 if (ncmds > IOCTLS_MAX_COUNT) { 404 error = EINVAL; 405 goto out_free; 406 } 407 408 fdp = td->td_proc->p_fd; 409 FILEDESC_XLOCK(fdp); 410 411 if (fget_locked(fdp, fd) == NULL) { 412 error = EBADF; 413 goto out; 414 } 415 416 error = cap_ioctl_limit_check(fdp, fd, cmds, ncmds); 417 if (error != 0) 418 goto out; 419 420 ocmds = fdp->fd_ofiles[fd].fde_ioctls; 421 fdp->fd_ofiles[fd].fde_ioctls = cmds; 422 fdp->fd_ofiles[fd].fde_nioctls = ncmds; 423 424 cmds = ocmds; 425 error = 0; 426 out: 427 FILEDESC_XUNLOCK(fdp); 428 out_free: 429 free(cmds, M_FILECAPS); 430 return (error); 431 } 432 433 int 434 sys_cap_ioctls_limit(struct thread *td, struct cap_ioctls_limit_args *uap) 435 { 436 u_long *cmds; 437 size_t ncmds; 438 int error; 439 440 ncmds = uap->ncmds; 441 442 if (ncmds > IOCTLS_MAX_COUNT) 443 return (EINVAL); 444 445 if (ncmds == 0) { 446 cmds = NULL; 447 } else { 448 cmds = malloc(sizeof(cmds[0]) * ncmds, M_FILECAPS, M_WAITOK); 449 error = copyin(uap->cmds, cmds, sizeof(cmds[0]) * ncmds); 450 if (error != 0) { 451 free(cmds, M_FILECAPS); 452 return (error); 453 } 454 } 455 456 return (kern_cap_ioctls_limit(td, uap->fd, cmds, ncmds)); 457 } 458 459 int 460 sys_cap_ioctls_get(struct thread *td, struct cap_ioctls_get_args *uap) 461 { 462 struct filedesc *fdp; 463 struct filedescent *fdep; 464 u_long *cmdsp, *dstcmds; 465 size_t maxcmds, ncmds; 466 int16_t count; 467 int error, fd; 468 469 fd = uap->fd; 470 dstcmds = uap->cmds; 471 maxcmds = uap->maxcmds; 472 473 AUDIT_ARG_FD(fd); 474 475 fdp = td->td_proc->p_fd; 476 477 cmdsp = NULL; 478 if (dstcmds != NULL) { 479 cmdsp = malloc(sizeof(cmdsp[0]) * IOCTLS_MAX_COUNT, M_FILECAPS, 480 M_WAITOK | M_ZERO); 481 } 482 483 FILEDESC_SLOCK(fdp); 484 fdep = fdeget_locked(fdp, fd); 485 if (fdep == NULL) { 486 error = EBADF; 487 FILEDESC_SUNLOCK(fdp); 488 goto out; 489 } 490 count = fdep->fde_nioctls; 491 if (count != -1 && cmdsp != NULL) { 492 ncmds = MIN(count, maxcmds); 493 memcpy(cmdsp, fdep->fde_ioctls, sizeof(cmdsp[0]) * ncmds); 494 } 495 FILEDESC_SUNLOCK(fdp); 496 497 /* 498 * If all ioctls are allowed (fde_nioctls == -1 && fde_ioctls == NULL) 499 * the only sane thing we can do is to not populate the given array and 500 * return CAP_IOCTLS_ALL. 501 */ 502 if (count != -1) { 503 if (cmdsp != NULL) { 504 error = copyout(cmdsp, dstcmds, 505 sizeof(cmdsp[0]) * ncmds); 506 if (error != 0) 507 goto out; 508 } 509 td->td_retval[0] = count; 510 } else { 511 td->td_retval[0] = CAP_IOCTLS_ALL; 512 } 513 514 error = 0; 515 out: 516 free(cmdsp, M_FILECAPS); 517 return (error); 518 } 519 520 /* 521 * Test whether a capability grants the given fcntl command. 522 */ 523 int 524 cap_fcntl_check_fde(struct filedescent *fde, int cmd) 525 { 526 uint32_t fcntlcap; 527 528 fcntlcap = (1 << cmd); 529 KASSERT((CAP_FCNTL_ALL & fcntlcap) != 0, 530 ("Unsupported fcntl=%d.", cmd)); 531 532 if ((fde->fde_fcntls & fcntlcap) != 0) 533 return (0); 534 535 return (ENOTCAPABLE); 536 } 537 538 int 539 cap_fcntl_check(struct filedesc *fdp, int fd, int cmd) 540 { 541 542 KASSERT(fd >= 0 && fd < fdp->fd_nfiles, 543 ("%s: invalid fd=%d", __func__, fd)); 544 545 return (cap_fcntl_check_fde(&fdp->fd_ofiles[fd], cmd)); 546 } 547 548 int 549 sys_cap_fcntls_limit(struct thread *td, struct cap_fcntls_limit_args *uap) 550 { 551 struct filedesc *fdp; 552 uint32_t fcntlrights; 553 int fd; 554 555 fd = uap->fd; 556 fcntlrights = uap->fcntlrights; 557 558 AUDIT_ARG_FD(fd); 559 AUDIT_ARG_FCNTL_RIGHTS(fcntlrights); 560 561 if ((fcntlrights & ~CAP_FCNTL_ALL) != 0) 562 return (EINVAL); 563 564 fdp = td->td_proc->p_fd; 565 FILEDESC_XLOCK(fdp); 566 567 if (fget_locked(fdp, fd) == NULL) { 568 FILEDESC_XUNLOCK(fdp); 569 return (EBADF); 570 } 571 572 if ((fcntlrights & ~fdp->fd_ofiles[fd].fde_fcntls) != 0) { 573 FILEDESC_XUNLOCK(fdp); 574 return (ENOTCAPABLE); 575 } 576 577 fdp->fd_ofiles[fd].fde_fcntls = fcntlrights; 578 FILEDESC_XUNLOCK(fdp); 579 580 return (0); 581 } 582 583 int 584 sys_cap_fcntls_get(struct thread *td, struct cap_fcntls_get_args *uap) 585 { 586 struct filedesc *fdp; 587 uint32_t rights; 588 int fd; 589 590 fd = uap->fd; 591 592 AUDIT_ARG_FD(fd); 593 594 fdp = td->td_proc->p_fd; 595 FILEDESC_SLOCK(fdp); 596 if (fget_locked(fdp, fd) == NULL) { 597 FILEDESC_SUNLOCK(fdp); 598 return (EBADF); 599 } 600 rights = fdp->fd_ofiles[fd].fde_fcntls; 601 FILEDESC_SUNLOCK(fdp); 602 603 return (copyout(&rights, uap->fcntlrightsp, sizeof(rights))); 604 } 605 606 #else /* !CAPABILITIES */ 607 608 /* 609 * Stub Capability functions for when options CAPABILITIES isn't compiled 610 * into the kernel. 611 */ 612 613 int 614 sys_cap_rights_limit(struct thread *td, struct cap_rights_limit_args *uap) 615 { 616 617 return (ENOSYS); 618 } 619 620 int 621 sys___cap_rights_get(struct thread *td, struct __cap_rights_get_args *uap) 622 { 623 624 return (ENOSYS); 625 } 626 627 int 628 sys_cap_ioctls_limit(struct thread *td, struct cap_ioctls_limit_args *uap) 629 { 630 631 return (ENOSYS); 632 } 633 634 int 635 sys_cap_ioctls_get(struct thread *td, struct cap_ioctls_get_args *uap) 636 { 637 638 return (ENOSYS); 639 } 640 641 int 642 sys_cap_fcntls_limit(struct thread *td, struct cap_fcntls_limit_args *uap) 643 { 644 645 return (ENOSYS); 646 } 647 648 int 649 sys_cap_fcntls_get(struct thread *td, struct cap_fcntls_get_args *uap) 650 { 651 652 return (ENOSYS); 653 } 654 655 #endif /* CAPABILITIES */ 656