Commit | Line | Data |
---|---|---|
b2441318 | 1 | /* SPDX-License-Identifier: GPL-2.0 */ |
1da177e4 LT |
2 | /* |
3 | * This is <linux/capability.h> | |
4 | * | |
b5376771 | 5 | * Andrew G. Morgan <morgan@kernel.org> |
1da177e4 LT |
6 | * Alexander Kjeldaas <astor@guardian.no> |
7 | * with help from Aleph1, Roland Buresund and Andrew Main. | |
8 | * | |
9 | * See here for the libcap library ("POSIX draft" compliance): | |
10 | * | |
bcf56442 | 11 | * ftp://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.6/ |
b5376771 | 12 | */ |
1da177e4 LT |
13 | #ifndef _LINUX_CAPABILITY_H |
14 | #define _LINUX_CAPABILITY_H | |
15 | ||
607ca46e | 16 | #include <uapi/linux/capability.h> |
2fec30e2 | 17 | #include <linux/uidgid.h> |
f122a08b | 18 | #include <linux/bits.h> |
ca05a99a AM |
19 | |
20 | #define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3 | |
1da177e4 | 21 | |
9fa91d99 | 22 | extern int file_caps_enabled; |
9fa91d99 | 23 | |
f122a08b | 24 | typedef struct { u64 val; } kernel_cap_t; |
1da177e4 | 25 | |
2fec30e2 | 26 | /* same as vfs_ns_cap_data but in cpu endian and always filled completely */ |
c0b00441 EP |
27 | struct cpu_vfs_cap_data { |
28 | __u32 magic_etc; | |
f122a08b | 29 | kuid_t rootid; |
c0b00441 EP |
30 | kernel_cap_t permitted; |
31 | kernel_cap_t inheritable; | |
32 | }; | |
33 | ||
e338d263 | 34 | #define _USER_CAP_HEADER_SIZE (sizeof(struct __user_cap_header_struct)) |
1da177e4 LT |
35 | #define _KERNEL_CAP_T_SIZE (sizeof(kernel_cap_t)) |
36 | ||
935d8aab | 37 | struct file; |
1a48e2ac | 38 | struct inode; |
3486740a | 39 | struct dentry; |
db3f6001 | 40 | struct task_struct; |
3486740a | 41 | struct user_namespace; |
39f60c1c | 42 | struct mnt_idmap; |
3486740a | 43 | |
0ad30b8f SH |
44 | /* |
45 | * CAP_FS_MASK and CAP_NFSD_MASKS: | |
46 | * | |
47 | * The fs mask is all the privileges that fsuid==0 historically meant. | |
48 | * At one time in the past, that included CAP_MKNOD and CAP_LINUX_IMMUTABLE. | |
49 | * | |
50 | * It has never meant setting security.* and trusted.* xattrs. | |
51 | * | |
52 | * We could also define fsmask as follows: | |
53 | * 1. CAP_FS_MASK is the privilege to bypass all fs-related DAC permissions | |
54 | * 2. The security.* and trusted.* xattrs are fs-related MAC permissions | |
55 | */ | |
56 | ||
f122a08b LT |
57 | # define CAP_FS_MASK (BIT_ULL(CAP_CHOWN) \ |
58 | | BIT_ULL(CAP_MKNOD) \ | |
59 | | BIT_ULL(CAP_DAC_OVERRIDE) \ | |
60 | | BIT_ULL(CAP_DAC_READ_SEARCH) \ | |
61 | | BIT_ULL(CAP_FOWNER) \ | |
62 | | BIT_ULL(CAP_FSETID) \ | |
63 | | BIT_ULL(CAP_MAC_OVERRIDE)) | |
64 | #define CAP_VALID_MASK (BIT_ULL(CAP_LAST_CAP+1)-1) | |
65 | ||
66 | # define CAP_EMPTY_SET ((kernel_cap_t) { 0 }) | |
67 | # define CAP_FULL_SET ((kernel_cap_t) { CAP_VALID_MASK }) | |
68 | # define CAP_FS_SET ((kernel_cap_t) { CAP_FS_MASK | BIT_ULL(CAP_LINUX_IMMUTABLE) }) | |
69 | # define CAP_NFSD_SET ((kernel_cap_t) { CAP_FS_MASK | BIT_ULL(CAP_SYS_RESOURCE) }) | |
70 | ||
71 | # define cap_clear(c) do { (c).val = 0; } while (0) | |
72 | ||
73 | #define cap_raise(c, flag) ((c).val |= BIT_ULL(flag)) | |
74 | #define cap_lower(c, flag) ((c).val &= ~BIT_ULL(flag)) | |
75 | #define cap_raised(c, flag) (((c).val & BIT_ULL(flag)) != 0) | |
e338d263 AM |
76 | |
77 | static inline kernel_cap_t cap_combine(const kernel_cap_t a, | |
78 | const kernel_cap_t b) | |
79 | { | |
f122a08b | 80 | return (kernel_cap_t) { a.val | b.val }; |
e338d263 | 81 | } |
1da177e4 | 82 | |
e338d263 AM |
83 | static inline kernel_cap_t cap_intersect(const kernel_cap_t a, |
84 | const kernel_cap_t b) | |
85 | { | |
f122a08b | 86 | return (kernel_cap_t) { a.val & b.val }; |
e338d263 | 87 | } |
1da177e4 | 88 | |
e338d263 AM |
89 | static inline kernel_cap_t cap_drop(const kernel_cap_t a, |
90 | const kernel_cap_t drop) | |
91 | { | |
f122a08b | 92 | return (kernel_cap_t) { a.val &~ drop.val }; |
e338d263 | 93 | } |
1da177e4 | 94 | |
e42852bf | 95 | static inline bool cap_isclear(const kernel_cap_t a) |
e338d263 | 96 | { |
f122a08b | 97 | return !a.val; |
e338d263 | 98 | } |
1da177e4 | 99 | |
a4eecbae MG |
100 | static inline bool cap_isidentical(const kernel_cap_t a, const kernel_cap_t b) |
101 | { | |
f122a08b | 102 | return a.val == b.val; |
a4eecbae MG |
103 | } |
104 | ||
9d36be76 EP |
105 | /* |
106 | * Check if "a" is a subset of "set". | |
e42852bf YB |
107 | * return true if ALL of the capabilities in "a" are also in "set" |
108 | * cap_issubset(0101, 1111) will return true | |
109 | * return false if ANY of the capabilities in "a" are not in "set" | |
110 | * cap_issubset(1111, 0101) will return false | |
9d36be76 | 111 | */ |
e42852bf | 112 | static inline bool cap_issubset(const kernel_cap_t a, const kernel_cap_t set) |
e338d263 | 113 | { |
f122a08b | 114 | return !(a.val & ~set.val); |
e338d263 | 115 | } |
1da177e4 | 116 | |
e338d263 | 117 | /* Used to decide between falling back on the old suser() or fsuser(). */ |
1da177e4 | 118 | |
e338d263 | 119 | static inline kernel_cap_t cap_drop_fs_set(const kernel_cap_t a) |
1da177e4 | 120 | { |
f122a08b | 121 | return cap_drop(a, CAP_FS_SET); |
1da177e4 LT |
122 | } |
123 | ||
e338d263 AM |
124 | static inline kernel_cap_t cap_raise_fs_set(const kernel_cap_t a, |
125 | const kernel_cap_t permitted) | |
1da177e4 | 126 | { |
f122a08b | 127 | return cap_combine(a, cap_intersect(permitted, CAP_FS_SET)); |
1da177e4 LT |
128 | } |
129 | ||
e338d263 | 130 | static inline kernel_cap_t cap_drop_nfsd_set(const kernel_cap_t a) |
1da177e4 | 131 | { |
f122a08b | 132 | return cap_drop(a, CAP_NFSD_SET); |
1da177e4 LT |
133 | } |
134 | ||
e338d263 AM |
135 | static inline kernel_cap_t cap_raise_nfsd_set(const kernel_cap_t a, |
136 | const kernel_cap_t permitted) | |
137 | { | |
f122a08b | 138 | return cap_combine(a, cap_intersect(permitted, CAP_NFSD_SET)); |
e338d263 | 139 | } |
1da177e4 | 140 | |
2813893f | 141 | #ifdef CONFIG_MULTIUSER |
3263245d SH |
142 | extern bool has_capability(struct task_struct *t, int cap); |
143 | extern bool has_ns_capability(struct task_struct *t, | |
144 | struct user_namespace *ns, int cap); | |
145 | extern bool has_capability_noaudit(struct task_struct *t, int cap); | |
7b61d648 EP |
146 | extern bool has_ns_capability_noaudit(struct task_struct *t, |
147 | struct user_namespace *ns, int cap); | |
3486740a SH |
148 | extern bool capable(int cap); |
149 | extern bool ns_capable(struct user_namespace *ns, int cap); | |
98f368e9 | 150 | extern bool ns_capable_noaudit(struct user_namespace *ns, int cap); |
40852275 | 151 | extern bool ns_capable_setid(struct user_namespace *ns, int cap); |
2813893f IM |
152 | #else |
153 | static inline bool has_capability(struct task_struct *t, int cap) | |
154 | { | |
155 | return true; | |
156 | } | |
157 | static inline bool has_ns_capability(struct task_struct *t, | |
158 | struct user_namespace *ns, int cap) | |
159 | { | |
160 | return true; | |
161 | } | |
162 | static inline bool has_capability_noaudit(struct task_struct *t, int cap) | |
163 | { | |
164 | return true; | |
165 | } | |
166 | static inline bool has_ns_capability_noaudit(struct task_struct *t, | |
167 | struct user_namespace *ns, int cap) | |
168 | { | |
169 | return true; | |
170 | } | |
171 | static inline bool capable(int cap) | |
172 | { | |
173 | return true; | |
174 | } | |
175 | static inline bool ns_capable(struct user_namespace *ns, int cap) | |
176 | { | |
177 | return true; | |
178 | } | |
98f368e9 TH |
179 | static inline bool ns_capable_noaudit(struct user_namespace *ns, int cap) |
180 | { | |
181 | return true; | |
182 | } | |
40852275 MM |
183 | static inline bool ns_capable_setid(struct user_namespace *ns, int cap) |
184 | { | |
185 | return true; | |
186 | } | |
2813893f | 187 | #endif /* CONFIG_MULTIUSER */ |
0558c1bf | 188 | bool privileged_wrt_inode_uidgid(struct user_namespace *ns, |
9452e93e | 189 | struct mnt_idmap *idmap, |
0558c1bf | 190 | const struct inode *inode); |
9452e93e | 191 | bool capable_wrt_inode_uidgid(struct mnt_idmap *idmap, |
0558c1bf | 192 | const struct inode *inode, int cap); |
935d8aab | 193 | extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap); |
64b875f7 | 194 | extern bool ptracer_capable(struct task_struct *tsk, struct user_namespace *ns); |
98073728 AB |
195 | static inline bool perfmon_capable(void) |
196 | { | |
197 | return capable(CAP_PERFMON) || capable(CAP_SYS_ADMIN); | |
198 | } | |
c59ede7b | 199 | |
a17b53c4 AS |
200 | static inline bool bpf_capable(void) |
201 | { | |
202 | return capable(CAP_BPF) || capable(CAP_SYS_ADMIN); | |
203 | } | |
204 | ||
124ea650 AR |
205 | static inline bool checkpoint_restore_ns_capable(struct user_namespace *ns) |
206 | { | |
207 | return ns_capable(ns, CAP_CHECKPOINT_RESTORE) || | |
208 | ns_capable(ns, CAP_SYS_ADMIN); | |
209 | } | |
210 | ||
851f7ff5 | 211 | /* audit system wants to get cap info from files as well */ |
39f60c1c | 212 | int get_vfs_caps_from_disk(struct mnt_idmap *idmap, |
71bc356f CB |
213 | const struct dentry *dentry, |
214 | struct cpu_vfs_cap_data *cpu_caps); | |
851f7ff5 | 215 | |
39f60c1c | 216 | int cap_convert_nscap(struct mnt_idmap *idmap, struct dentry *dentry, |
e65ce2a5 | 217 | const void **ivalue, size_t size); |
8db6c34f | 218 | |
1da177e4 | 219 | #endif /* !_LINUX_CAPABILITY_H */ |