xref: /freebsd/sys/kern/sys_capability.c (revision cbd30a72ca196976c1c700400ecd424baa1b9c16) 
1 /*-
2  * Copyright (c) 2008-2011 Robert N. M. Watson
3  * Copyright (c) 2010-2011 Jonathan Anderson
4  * Copyright (c) 2012 FreeBSD Foundation
5  * All rights reserved.
6  *
7  * This software was developed at the University of Cambridge Computer
8  * Laboratory with support from a grant from Google, Inc.
9  *
10  * Portions of this software were developed by Pawel Jakub Dawidek under
11  * sponsorship from the FreeBSD Foundation.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  */
34 
35 /*
36  * FreeBSD kernel capability facility.
37  *
38  * Two kernel features are implemented here: capability mode, a sandboxed mode
39  * of execution for processes, and capabilities, a refinement on file
40  * descriptors that allows fine-grained control over operations on the file
41  * descriptor.  Collectively, these allow processes to run in the style of a
42  * historic "capability system" in which they can use only resources
43  * explicitly delegated to them.  This model is enforced by restricting access
44  * to global namespaces in capability mode.
45  *
46  * Capabilities wrap other file descriptor types, binding them to a constant
47  * rights mask set when the capability is created.  New capabilities may be
48  * derived from existing capabilities, but only if they have the same or a
49  * strict subset of the rights on the original capability.
50  *
51  * System calls permitted in capability mode are defined in capabilities.conf;
52  * calls must be carefully audited for safety to ensure that they don't allow
53  * escape from a sandbox.  Some calls permit only a subset of operations in
54  * capability mode -- for example, shm_open(2) is limited to creating
55  * anonymous, rather than named, POSIX shared memory objects.
56  */
57 
58 #include <sys/cdefs.h>
59 __FBSDID("$FreeBSD$");
60 
61 #include "opt_capsicum.h"
62 #include "opt_ktrace.h"
63 
64 #include <sys/param.h>
65 #include <sys/capsicum.h>
66 #include <sys/file.h>
67 #include <sys/filedesc.h>
68 #include <sys/kernel.h>
69 #include <sys/limits.h>
70 #include <sys/lock.h>
71 #include <sys/mutex.h>
72 #include <sys/proc.h>
73 #include <sys/syscallsubr.h>
74 #include <sys/sysproto.h>
75 #include <sys/sysctl.h>
76 #include <sys/systm.h>
77 #include <sys/ucred.h>
78 #include <sys/uio.h>
79 #include <sys/ktrace.h>
80 
81 #include <security/audit/audit.h>
82 
83 #include <vm/uma.h>
84 #include <vm/vm.h>
85 
86 int trap_enotcap;
87 SYSCTL_INT(_kern, OID_AUTO, trap_enotcap, CTLFLAG_RW, &trap_enotcap, 0,
88     "Deliver SIGTRAP on ENOTCAPABLE");
89 
90 #ifdef CAPABILITY_MODE
91 
92 #define        IOCTLS_MAX_COUNT        256     /* XXX: Is 256 sane? */
93 
94 FEATURE(security_capability_mode, "Capsicum Capability Mode");
95 
96 /*
97  * System call to enter capability mode for the process.
98  */
99 int
100 sys_cap_enter(struct thread *td, struct cap_enter_args *uap)
101 {
102 	struct ucred *newcred, *oldcred;
103 	struct proc *p;
104 
105 	if (IN_CAPABILITY_MODE(td))
106 		return (0);
107 
108 	newcred = crget();
109 	p = td->td_proc;
110 	PROC_LOCK(p);
111 	oldcred = crcopysafe(p, newcred);
112 	newcred->cr_flags |= CRED_FLAG_CAPMODE;
113 	proc_set_cred(p, newcred);
114 	PROC_UNLOCK(p);
115 	crfree(oldcred);
116 	return (0);
117 }
118 
119 /*
120  * System call to query whether the process is in capability mode.
121  */
122 int
123 sys_cap_getmode(struct thread *td, struct cap_getmode_args *uap)
124 {
125 	u_int i;
126 
127 	i = IN_CAPABILITY_MODE(td) ? 1 : 0;
128 	return (copyout(&i, uap->modep, sizeof(i)));
129 }
130 
131 #else /* !CAPABILITY_MODE */
132 
133 int
134 sys_cap_enter(struct thread *td, struct cap_enter_args *uap)
135 {
136 
137 	return (ENOSYS);
138 }
139 
140 int
141 sys_cap_getmode(struct thread *td, struct cap_getmode_args *uap)
142 {
143 
144 	return (ENOSYS);
145 }
146 
147 #endif /* CAPABILITY_MODE */
148 
149 #ifdef CAPABILITIES
150 
151 FEATURE(security_capabilities, "Capsicum Capabilities");
152 
153 MALLOC_DECLARE(M_FILECAPS);
154 
155 static inline int
156 _cap_check(const cap_rights_t *havep, const cap_rights_t *needp,
157     enum ktr_cap_fail_type type)
158 {
159 
160 	if (!cap_rights_contains(havep, needp)) {
161 #ifdef KTRACE
162 		if (KTRPOINT(curthread, KTR_CAPFAIL))
163 			ktrcapfail(type, needp, havep);
164 #endif
165 		return (ENOTCAPABLE);
166 	}
167 	return (0);
168 }
169 
170 /*
171  * Test whether a capability grants the requested rights.
172  */
173 int
174 cap_check(const cap_rights_t *havep, const cap_rights_t *needp)
175 {
176 
177 	return (_cap_check(havep, needp, CAPFAIL_NOTCAPABLE));
178 }
179 
180 /*
181  * Convert capability rights into VM access flags.
182  */
183 u_char
184 cap_rights_to_vmprot(cap_rights_t *havep)
185 {
186 	u_char maxprot;
187 
188 	maxprot = VM_PROT_NONE;
189 	if (cap_rights_is_set(havep, CAP_MMAP_R))
190 		maxprot |= VM_PROT_READ;
191 	if (cap_rights_is_set(havep, CAP_MMAP_W))
192 		maxprot |= VM_PROT_WRITE;
193 	if (cap_rights_is_set(havep, CAP_MMAP_X))
194 		maxprot |= VM_PROT_EXECUTE;
195 
196 	return (maxprot);
197 }
198 
199 /*
200  * Extract rights from a capability for monitoring purposes -- not for use in
201  * any other way, as we want to keep all capability permission evaluation in
202  * this one file.
203  */
204 
205 cap_rights_t *
206 cap_rights_fde(struct filedescent *fde)
207 {
208 
209 	return (&fde->fde_rights);
210 }
211 
212 cap_rights_t *
213 cap_rights(struct filedesc *fdp, int fd)
214 {
215 
216 	return (cap_rights_fde(&fdp->fd_ofiles[fd]));
217 }
218 
219 int
220 kern_cap_rights_limit(struct thread *td, int fd, cap_rights_t *rights)
221 {
222 	struct filedesc *fdp;
223 	int error;
224 
225 	fdp = td->td_proc->p_fd;
226 	FILEDESC_XLOCK(fdp);
227 	if (fget_locked(fdp, fd) == NULL) {
228 		FILEDESC_XUNLOCK(fdp);
229 		return (EBADF);
230 	}
231 	error = _cap_check(cap_rights(fdp, fd), rights, CAPFAIL_INCREASE);
232 	if (error == 0) {
233 		fdp->fd_ofiles[fd].fde_rights = *rights;
234 		if (!cap_rights_is_set(rights, CAP_IOCTL)) {
235 			free(fdp->fd_ofiles[fd].fde_ioctls, M_FILECAPS);
236 			fdp->fd_ofiles[fd].fde_ioctls = NULL;
237 			fdp->fd_ofiles[fd].fde_nioctls = 0;
238 		}
239 		if (!cap_rights_is_set(rights, CAP_FCNTL))
240 			fdp->fd_ofiles[fd].fde_fcntls = 0;
241 	}
242 	FILEDESC_XUNLOCK(fdp);
243 	return (error);
244 }
245 
246 /*
247  * System call to limit rights of the given capability.
248  */
249 int
250 sys_cap_rights_limit(struct thread *td, struct cap_rights_limit_args *uap)
251 {
252 	cap_rights_t rights;
253 	int error, version;
254 
255 	cap_rights_init(&rights);
256 
257 	error = copyin(uap->rightsp, &rights, sizeof(rights.cr_rights[0]));
258 	if (error != 0)
259 		return (error);
260 	version = CAPVER(&rights);
261 	if (version != CAP_RIGHTS_VERSION_00)
262 		return (EINVAL);
263 
264 	error = copyin(uap->rightsp, &rights,
265 	    sizeof(rights.cr_rights[0]) * CAPARSIZE(&rights));
266 	if (error != 0)
267 		return (error);
268 	/* Check for race. */
269 	if (CAPVER(&rights) != version)
270 		return (EINVAL);
271 
272 	if (!cap_rights_is_valid(&rights))
273 		return (EINVAL);
274 
275 	if (version != CAP_RIGHTS_VERSION) {
276 		rights.cr_rights[0] &= ~(0x3ULL << 62);
277 		rights.cr_rights[0] |= ((uint64_t)CAP_RIGHTS_VERSION << 62);
278 	}
279 #ifdef KTRACE
280 	if (KTRPOINT(td, KTR_STRUCT))
281 		ktrcaprights(&rights);
282 #endif
283 
284 	AUDIT_ARG_FD(uap->fd);
285 	AUDIT_ARG_RIGHTS(&rights);
286 	return (kern_cap_rights_limit(td, uap->fd, &rights));
287 }
288 
289 /*
290  * System call to query the rights mask associated with a capability.
291  */
292 int
293 sys___cap_rights_get(struct thread *td, struct __cap_rights_get_args *uap)
294 {
295 	struct filedesc *fdp;
296 	cap_rights_t rights;
297 	int error, fd, i, n;
298 
299 	if (uap->version != CAP_RIGHTS_VERSION_00)
300 		return (EINVAL);
301 
302 	fd = uap->fd;
303 
304 	AUDIT_ARG_FD(fd);
305 
306 	fdp = td->td_proc->p_fd;
307 	FILEDESC_SLOCK(fdp);
308 	if (fget_locked(fdp, fd) == NULL) {
309 		FILEDESC_SUNLOCK(fdp);
310 		return (EBADF);
311 	}
312 	rights = *cap_rights(fdp, fd);
313 	FILEDESC_SUNLOCK(fdp);
314 	n = uap->version + 2;
315 	if (uap->version != CAPVER(&rights)) {
316 		/*
317 		 * For older versions we need to check if the descriptor
318 		 * doesn't contain rights not understood by the caller.
319 		 * If it does, we have to return an error.
320 		 */
321 		for (i = n; i < CAPARSIZE(&rights); i++) {
322 			if ((rights.cr_rights[i] & ~(0x7FULL << 57)) != 0)
323 				return (EINVAL);
324 		}
325 	}
326 	error = copyout(&rights, uap->rightsp, sizeof(rights.cr_rights[0]) * n);
327 #ifdef KTRACE
328 	if (error == 0 && KTRPOINT(td, KTR_STRUCT))
329 		ktrcaprights(&rights);
330 #endif
331 	return (error);
332 }
333 
334 /*
335  * Test whether a capability grants the given ioctl command.
336  * If descriptor doesn't have CAP_IOCTL, then ioctls list is empty and
337  * ENOTCAPABLE will be returned.
338  */
339 int
340 cap_ioctl_check(struct filedesc *fdp, int fd, u_long cmd)
341 {
342 	u_long *cmds;
343 	ssize_t ncmds;
344 	long i;
345 
346 	FILEDESC_LOCK_ASSERT(fdp);
347 	KASSERT(fd >= 0 && fd < fdp->fd_nfiles,
348 	    ("%s: invalid fd=%d", __func__, fd));
349 
350 	ncmds = fdp->fd_ofiles[fd].fde_nioctls;
351 	if (ncmds == -1)
352 		return (0);
353 
354 	cmds = fdp->fd_ofiles[fd].fde_ioctls;
355 	for (i = 0; i < ncmds; i++) {
356 		if (cmds[i] == cmd)
357 			return (0);
358 	}
359 
360 	return (ENOTCAPABLE);
361 }
362 
363 /*
364  * Check if the current ioctls list can be replaced by the new one.
365  */
366 static int
367 cap_ioctl_limit_check(struct filedesc *fdp, int fd, const u_long *cmds,
368     size_t ncmds)
369 {
370 	u_long *ocmds;
371 	ssize_t oncmds;
372 	u_long i;
373 	long j;
374 
375 	oncmds = fdp->fd_ofiles[fd].fde_nioctls;
376 	if (oncmds == -1)
377 		return (0);
378 	if (oncmds < (ssize_t)ncmds)
379 		return (ENOTCAPABLE);
380 
381 	ocmds = fdp->fd_ofiles[fd].fde_ioctls;
382 	for (i = 0; i < ncmds; i++) {
383 		for (j = 0; j < oncmds; j++) {
384 			if (cmds[i] == ocmds[j])
385 				break;
386 		}
387 		if (j == oncmds)
388 			return (ENOTCAPABLE);
389 	}
390 
391 	return (0);
392 }
393 
394 int
395 kern_cap_ioctls_limit(struct thread *td, int fd, u_long *cmds, size_t ncmds)
396 {
397 	struct filedesc *fdp;
398 	u_long *ocmds;
399 	int error;
400 
401 	AUDIT_ARG_FD(fd);
402 
403 	if (ncmds > IOCTLS_MAX_COUNT) {
404 		error = EINVAL;
405 		goto out_free;
406 	}
407 
408 	fdp = td->td_proc->p_fd;
409 	FILEDESC_XLOCK(fdp);
410 
411 	if (fget_locked(fdp, fd) == NULL) {
412 		error = EBADF;
413 		goto out;
414 	}
415 
416 	error = cap_ioctl_limit_check(fdp, fd, cmds, ncmds);
417 	if (error != 0)
418 		goto out;
419 
420 	ocmds = fdp->fd_ofiles[fd].fde_ioctls;
421 	fdp->fd_ofiles[fd].fde_ioctls = cmds;
422 	fdp->fd_ofiles[fd].fde_nioctls = ncmds;
423 
424 	cmds = ocmds;
425 	error = 0;
426 out:
427 	FILEDESC_XUNLOCK(fdp);
428 out_free:
429 	free(cmds, M_FILECAPS);
430 	return (error);
431 }
432 
433 int
434 sys_cap_ioctls_limit(struct thread *td, struct cap_ioctls_limit_args *uap)
435 {
436 	u_long *cmds;
437 	size_t ncmds;
438 	int error;
439 
440 	ncmds = uap->ncmds;
441 
442 	if (ncmds > IOCTLS_MAX_COUNT)
443 		return (EINVAL);
444 
445 	if (ncmds == 0) {
446 		cmds = NULL;
447 	} else {
448 		cmds = malloc(sizeof(cmds[0]) * ncmds, M_FILECAPS, M_WAITOK);
449 		error = copyin(uap->cmds, cmds, sizeof(cmds[0]) * ncmds);
450 		if (error != 0) {
451 			free(cmds, M_FILECAPS);
452 			return (error);
453 		}
454 	}
455 
456 	return (kern_cap_ioctls_limit(td, uap->fd, cmds, ncmds));
457 }
458 
459 int
460 sys_cap_ioctls_get(struct thread *td, struct cap_ioctls_get_args *uap)
461 {
462 	struct filedesc *fdp;
463 	struct filedescent *fdep;
464 	u_long *cmdsp, *dstcmds;
465 	size_t maxcmds, ncmds;
466 	int16_t count;
467 	int error, fd;
468 
469 	fd = uap->fd;
470 	dstcmds = uap->cmds;
471 	maxcmds = uap->maxcmds;
472 
473 	AUDIT_ARG_FD(fd);
474 
475 	fdp = td->td_proc->p_fd;
476 
477 	cmdsp = NULL;
478 	if (dstcmds != NULL) {
479 		cmdsp = malloc(sizeof(cmdsp[0]) * IOCTLS_MAX_COUNT, M_FILECAPS,
480 		    M_WAITOK | M_ZERO);
481 	}
482 
483 	FILEDESC_SLOCK(fdp);
484 	fdep = fdeget_locked(fdp, fd);
485 	if (fdep == NULL) {
486 		error = EBADF;
487 		FILEDESC_SUNLOCK(fdp);
488 		goto out;
489 	}
490 	count = fdep->fde_nioctls;
491 	if (count != -1 && cmdsp != NULL) {
492 		ncmds = MIN(count, maxcmds);
493 		memcpy(cmdsp, fdep->fde_ioctls, sizeof(cmdsp[0]) * ncmds);
494 	}
495 	FILEDESC_SUNLOCK(fdp);
496 
497 	/*
498 	 * If all ioctls are allowed (fde_nioctls == -1 && fde_ioctls == NULL)
499 	 * the only sane thing we can do is to not populate the given array and
500 	 * return CAP_IOCTLS_ALL.
501 	 */
502 	if (count != -1) {
503 		if (cmdsp != NULL) {
504 			error = copyout(cmdsp, dstcmds,
505 			    sizeof(cmdsp[0]) * ncmds);
506 			if (error != 0)
507 				goto out;
508 		}
509 		td->td_retval[0] = count;
510 	} else {
511 		td->td_retval[0] = CAP_IOCTLS_ALL;
512 	}
513 
514 	error = 0;
515 out:
516 	free(cmdsp, M_FILECAPS);
517 	return (error);
518 }
519 
520 /*
521  * Test whether a capability grants the given fcntl command.
522  */
523 int
524 cap_fcntl_check_fde(struct filedescent *fde, int cmd)
525 {
526 	uint32_t fcntlcap;
527 
528 	fcntlcap = (1 << cmd);
529 	KASSERT((CAP_FCNTL_ALL & fcntlcap) != 0,
530 	    ("Unsupported fcntl=%d.", cmd));
531 
532 	if ((fde->fde_fcntls & fcntlcap) != 0)
533 		return (0);
534 
535 	return (ENOTCAPABLE);
536 }
537 
538 int
539 cap_fcntl_check(struct filedesc *fdp, int fd, int cmd)
540 {
541 
542 	KASSERT(fd >= 0 && fd < fdp->fd_nfiles,
543 	    ("%s: invalid fd=%d", __func__, fd));
544 
545 	return (cap_fcntl_check_fde(&fdp->fd_ofiles[fd], cmd));
546 }
547 
548 int
549 sys_cap_fcntls_limit(struct thread *td, struct cap_fcntls_limit_args *uap)
550 {
551 	struct filedesc *fdp;
552 	uint32_t fcntlrights;
553 	int fd;
554 
555 	fd = uap->fd;
556 	fcntlrights = uap->fcntlrights;
557 
558 	AUDIT_ARG_FD(fd);
559 	AUDIT_ARG_FCNTL_RIGHTS(fcntlrights);
560 
561 	if ((fcntlrights & ~CAP_FCNTL_ALL) != 0)
562 		return (EINVAL);
563 
564 	fdp = td->td_proc->p_fd;
565 	FILEDESC_XLOCK(fdp);
566 
567 	if (fget_locked(fdp, fd) == NULL) {
568 		FILEDESC_XUNLOCK(fdp);
569 		return (EBADF);
570 	}
571 
572 	if ((fcntlrights & ~fdp->fd_ofiles[fd].fde_fcntls) != 0) {
573 		FILEDESC_XUNLOCK(fdp);
574 		return (ENOTCAPABLE);
575 	}
576 
577 	fdp->fd_ofiles[fd].fde_fcntls = fcntlrights;
578 	FILEDESC_XUNLOCK(fdp);
579 
580 	return (0);
581 }
582 
583 int
584 sys_cap_fcntls_get(struct thread *td, struct cap_fcntls_get_args *uap)
585 {
586 	struct filedesc *fdp;
587 	uint32_t rights;
588 	int fd;
589 
590 	fd = uap->fd;
591 
592 	AUDIT_ARG_FD(fd);
593 
594 	fdp = td->td_proc->p_fd;
595 	FILEDESC_SLOCK(fdp);
596 	if (fget_locked(fdp, fd) == NULL) {
597 		FILEDESC_SUNLOCK(fdp);
598 		return (EBADF);
599 	}
600 	rights = fdp->fd_ofiles[fd].fde_fcntls;
601 	FILEDESC_SUNLOCK(fdp);
602 
603 	return (copyout(&rights, uap->fcntlrightsp, sizeof(rights)));
604 }
605 
606 #else /* !CAPABILITIES */
607 
608 /*
609  * Stub Capability functions for when options CAPABILITIES isn't compiled
610  * into the kernel.
611  */
612 
613 int
614 sys_cap_rights_limit(struct thread *td, struct cap_rights_limit_args *uap)
615 {
616 
617 	return (ENOSYS);
618 }
619 
620 int
621 sys___cap_rights_get(struct thread *td, struct __cap_rights_get_args *uap)
622 {
623 
624 	return (ENOSYS);
625 }
626 
627 int
628 sys_cap_ioctls_limit(struct thread *td, struct cap_ioctls_limit_args *uap)
629 {
630 
631 	return (ENOSYS);
632 }
633 
634 int
635 sys_cap_ioctls_get(struct thread *td, struct cap_ioctls_get_args *uap)
636 {
637 
638 	return (ENOSYS);
639 }
640 
641 int
642 sys_cap_fcntls_limit(struct thread *td, struct cap_fcntls_limit_args *uap)
643 {
644 
645 	return (ENOSYS);
646 }
647 
648 int
649 sys_cap_fcntls_get(struct thread *td, struct cap_fcntls_get_args *uap)
650 {
651 
652 	return (ENOSYS);
653 }
654 
655 #endif /* CAPABILITIES */
656