void drop_caps(const struct minijail *j) { cap_t caps = cap_get_proc(); cap_value_t flag[1]; const uint64_t one = 1; unsigned int i; if (!caps) die("can't get process caps"); if (cap_clear_flag(caps, CAP_INHERITABLE)) die("can't clear inheritable caps"); if (cap_clear_flag(caps, CAP_EFFECTIVE)) die("can't clear effective caps"); if (cap_clear_flag(caps, CAP_PERMITTED)) die("can't clear permitted caps"); for (i = 0; i < sizeof(j->caps) * 8 && run_cap_valid(i); ++i) { /* Keep CAP_SETPCAP for dropping bounding set bits. */ if (i != CAP_SETPCAP && !(j->caps & (one << i))) continue; flag[0] = i; if (cap_set_flag(caps, CAP_EFFECTIVE, 1, flag, CAP_SET)) die("can't add effective cap"); if (cap_set_flag(caps, CAP_PERMITTED, 1, flag, CAP_SET)) die("can't add permitted cap"); if (cap_set_flag(caps, CAP_INHERITABLE, 1, flag, CAP_SET)) die("can't add inheritable cap"); } if (cap_set_proc(caps)) die("can't apply initial cleaned capset"); /* * Instead of dropping bounding set first, do it here in case * the caller had a more permissive bounding set which could * have been used above to raise a capability that wasn't already * present. This requires CAP_SETPCAP, so we raised/kept it above. */ for (i = 0; i < sizeof(j->caps) * 8 && run_cap_valid(i); ++i) { if (j->caps & (one << i)) continue; if (prctl(PR_CAPBSET_DROP, i)) pdie("prctl(PR_CAPBSET_DROP)"); } /* If CAP_SETPCAP wasn't specifically requested, now we remove it. */ if ((j->caps & (one << CAP_SETPCAP)) == 0) { flag[0] = CAP_SETPCAP; if (cap_set_flag(caps, CAP_EFFECTIVE, 1, flag, CAP_CLEAR)) die("can't clear effective cap"); if (cap_set_flag(caps, CAP_PERMITTED, 1, flag, CAP_CLEAR)) die("can't clear permitted cap"); if (cap_set_flag(caps, CAP_INHERITABLE, 1, flag, CAP_CLEAR)) die("can't clear inheritable cap"); } if (cap_set_proc(caps)) die("can't apply final cleaned capset"); cap_free(caps); }
int lxc_caps_down(void) { cap_t caps; int ret; /* when we are run as root, we don't want to play * with the capabilities */ if (!getuid()) return 0; caps = cap_get_proc(); if (!caps) { ERROR("failed to cap_get_proc: %m"); return -1; } ret = cap_clear_flag(caps, CAP_EFFECTIVE); if (ret) { ERROR("failed to cap_clear_flag: %m"); goto out; } ret = cap_set_proc(caps); if (ret) { ERROR("failed to cap_set_proc: %m"); goto out; } out: cap_free(caps); return 0; }
void *drop_caps_and_wait(void *arg) { int fd = *((int *) arg); void *retcode = (void *)0xdeadbeaf; cap_t caps; char c; caps = cap_get_proc(); if (!caps) { err("cap_get_proc"); return NULL; } if (cap_clear_flag(caps, CAP_EFFECTIVE) < 0) { err("cap_clear_flag"); goto die; } if (cap_set_proc(caps) < 0) { err("cap_set_proc"); goto die; } if (write(fd, "a", 1) != 1) { err("Unable to send a status"); goto die; } if (read(fd, &c, 1) != 1) { err("Unable to read a status"); goto die; } retcode = NULL; die: cap_free(caps); return retcode; }
int main(int argc, char *argv[], char *envp[]) { pid_t child; unsigned i; child = 0; for (i=1; i<argc; ++i) { if (!memcmp("--drop=", argv[i], 4)) { char *ptr; cap_t orig, raised_for_setpcap; /* * We need to do this here because --inh=XXX may have reset * orig and it isn't until we are within the --drop code that * we know what the prevailing (orig) pI value is. */ orig = cap_get_proc(); if (orig == NULL) { perror("Capabilities not available"); exit(1); } raised_for_setpcap = cap_dup(orig); if (raised_for_setpcap == NULL) { fprintf(stderr, "BSET modification requires CAP_SETPCAP\n"); exit(1); } if (cap_set_flag(raised_for_setpcap, CAP_EFFECTIVE, 1, raise_setpcap, CAP_SET) != 0) { perror("unable to select CAP_SETPCAP"); exit(1); } if (strcmp("all", argv[i]+7) == 0) { unsigned j = 0; while (CAP_IS_SUPPORTED(j)) { if (cap_drop_bound(j) != 0) { char *name_ptr; name_ptr = cap_to_name(j); fprintf(stderr, "Unable to drop bounding capability [%s]\n", name_ptr); cap_free(name_ptr); exit(1); } j++; } } else { for (ptr = argv[i]+7; (ptr = strtok(ptr, ",")); ptr = NULL) { /* find name for token */ cap_value_t cap; int status; if (cap_from_name(ptr, &cap) != 0) { fprintf(stderr, "capability [%s] is unknown to libcap\n", ptr); exit(1); } if (cap_set_proc(raised_for_setpcap) != 0) { perror("unable to raise CAP_SETPCAP for BSET changes"); exit(1); } status = prctl(PR_CAPBSET_DROP, cap); if (cap_set_proc(orig) != 0) { perror("unable to lower CAP_SETPCAP post BSET change"); exit(1); } if (status) { fprintf(stderr, "failed to drop [%s=%u]\n", ptr, cap); exit(1); } } } cap_free(raised_for_setpcap); cap_free(orig); } else if (!memcmp("--inh=", argv[i], 6)) { cap_t all, raised_for_setpcap; char *text; char *ptr; all = cap_get_proc(); if (all == NULL) { perror("Capabilities not available"); exit(1); } if (cap_clear_flag(all, CAP_INHERITABLE) != 0) { perror("libcap:cap_clear_flag() internal error"); exit(1); } raised_for_setpcap = cap_dup(all); if ((raised_for_setpcap != NULL) && (cap_set_flag(raised_for_setpcap, CAP_EFFECTIVE, 1, raise_setpcap, CAP_SET) != 0)) { cap_free(raised_for_setpcap); raised_for_setpcap = NULL; } text = cap_to_text(all, NULL); cap_free(all); if (text == NULL) { perror("Fatal error concerning process capabilities"); exit(1); } ptr = malloc(10 + strlen(argv[i]+6) + strlen(text)); if (ptr == NULL) { perror("Out of memory for inh set"); exit(1); } if (argv[i][6] && strcmp("none", argv[i]+6)) { sprintf(ptr, "%s %s+i", text, argv[i]+6); } else { strcpy(ptr, text); } all = cap_from_text(ptr); if (all == NULL) { perror("Fatal error internalizing capabilities"); exit(1); } cap_free(text); free(ptr); if (raised_for_setpcap != NULL) { /* * This is only for the case that pP does not contain * the requested change to pI.. Failing here is not * indicative of the cap_set_proc(all) failing (always). */ (void) cap_set_proc(raised_for_setpcap); cap_free(raised_for_setpcap); raised_for_setpcap = NULL; } if (cap_set_proc(all) != 0) { perror("Unable to set inheritable capabilities"); exit(1); } /* * Since status is based on orig, we don't want to restore * the previous value of 'all' again here! */ cap_free(all); } else if (!memcmp("--caps=", argv[i], 7)) { cap_t all, raised_for_setpcap; raised_for_setpcap = cap_get_proc(); if (raised_for_setpcap == NULL) { perror("Capabilities not available"); exit(1); } if ((raised_for_setpcap != NULL) && (cap_set_flag(raised_for_setpcap, CAP_EFFECTIVE, 1, raise_setpcap, CAP_SET) != 0)) { cap_free(raised_for_setpcap); raised_for_setpcap = NULL; } all = cap_from_text(argv[i]+7); if (all == NULL) { fprintf(stderr, "unable to interpret [%s]\n", argv[i]); exit(1); } if (raised_for_setpcap != NULL) { /* * This is only for the case that pP does not contain * the requested change to pI.. Failing here is not * indicative of the cap_set_proc(all) failing (always). */ (void) cap_set_proc(raised_for_setpcap); cap_free(raised_for_setpcap); raised_for_setpcap = NULL; } if (cap_set_proc(all) != 0) { fprintf(stderr, "Unable to set capabilities [%s]\n", argv[i]); exit(1); } /* * Since status is based on orig, we don't want to restore * the previous value of 'all' again here! */ cap_free(all); } else if (!memcmp("--keep=", argv[i], 7)) { unsigned value; int set; value = strtoul(argv[i]+7, NULL, 0); set = prctl(PR_SET_KEEPCAPS, value); if (set < 0) { fprintf(stderr, "prctl(PR_SET_KEEPCAPS, %u) failed: %s\n", value, strerror(errno)); exit(1); } } else if (!memcmp("--chroot=", argv[i], 9)) { int status; cap_t orig, raised_for_chroot; orig = cap_get_proc(); if (orig == NULL) { perror("Capabilities not available"); exit(1); } raised_for_chroot = cap_dup(orig); if (raised_for_chroot == NULL) { perror("Unable to duplicate capabilities"); exit(1); } if (cap_set_flag(raised_for_chroot, CAP_EFFECTIVE, 1, raise_chroot, CAP_SET) != 0) { perror("unable to select CAP_SET_SYS_CHROOT"); exit(1); } if (cap_set_proc(raised_for_chroot) != 0) { perror("unable to raise CAP_SYS_CHROOT"); exit(1); } cap_free(raised_for_chroot); status = chroot(argv[i]+9); if (cap_set_proc(orig) != 0) { perror("unable to lower CAP_SYS_CHROOT"); exit(1); } /* * Given we are now in a new directory tree, its good practice * to start off in a sane location */ status = chdir("/"); cap_free(orig); if (status != 0) { fprintf(stderr, "Unable to chroot/chdir to [%s]", argv[i]+9); exit(1); } } else if (!memcmp("--secbits=", argv[i], 10)) { unsigned value; int status; value = strtoul(argv[i]+10, NULL, 0); status = prctl(PR_SET_SECUREBITS, value); if (status < 0) { fprintf(stderr, "failed to set securebits to 0%o/0x%x\n", value, value); exit(1); } } else if (!memcmp("--forkfor=", argv[i], 10)) { unsigned value; value = strtoul(argv[i]+10, NULL, 0); if (value == 0) { goto usage; } child = fork(); if (child < 0) { perror("unable to fork()"); } else if (!child) { sleep(value); exit(0); } } else if (!memcmp("--killit=", argv[i], 9)) { int retval, status; pid_t result; unsigned value; value = strtoul(argv[i]+9, NULL, 0); if (!child) { fprintf(stderr, "no forked process to kill\n"); exit(1); } retval = kill(child, value); if (retval != 0) { perror("Unable to kill child process"); exit(1); } result = waitpid(child, &status, 0); if (result != child) { fprintf(stderr, "waitpid didn't match child: %u != %u\n", child, result); exit(1); } if (WTERMSIG(status) != value) { fprintf(stderr, "child terminated with odd signal (%d != %d)\n" , value, WTERMSIG(status)); exit(1); } } else if (!memcmp("--uid=", argv[i], 6)) { unsigned value; int status; value = strtoul(argv[i]+6, NULL, 0); status = setuid(value); if (status < 0) { fprintf(stderr, "Failed to set uid=%u: %s\n", value, strerror(errno)); exit(1); } } else if (!memcmp("--gid=", argv[i], 6)) { unsigned value; int status; value = strtoul(argv[i]+6, NULL, 0); status = setgid(value); if (status < 0) { fprintf(stderr, "Failed to set gid=%u: %s\n", value, strerror(errno)); exit(1); } } else if (!memcmp("--groups=", argv[i], 9)) { char *ptr, *buf; long length, max_groups; gid_t *group_list; int g_count; length = sysconf(_SC_GETGR_R_SIZE_MAX); buf = calloc(1, length); if (NULL == buf) { fprintf(stderr, "No memory for [%s] operation\n", argv[i]); exit(1); } max_groups = sysconf(_SC_NGROUPS_MAX); group_list = calloc(max_groups, sizeof(gid_t)); if (NULL == group_list) { fprintf(stderr, "No memory for gid list\n"); exit(1); } g_count = 0; for (ptr = argv[i] + 9; (ptr = strtok(ptr, ",")); ptr = NULL, g_count++) { if (max_groups <= g_count) { fprintf(stderr, "Too many groups specified (%d)\n", g_count); exit(1); } if (!isdigit(*ptr)) { struct group *g, grp; getgrnam_r(ptr, &grp, buf, length, &g); if (NULL == g) { fprintf(stderr, "Failed to identify gid for group [%s]\n", ptr); exit(1); } group_list[g_count] = g->gr_gid; } else { group_list[g_count] = strtoul(ptr, NULL, 0); } } free(buf); if (setgroups(g_count, group_list) != 0) { fprintf(stderr, "Failed to setgroups.\n"); exit(1); } free(group_list); } else if (!memcmp("--user="******"User [%s] not known\n", user); exit(1); } ngroups = MAX_GROUPS; status = getgrouplist(user, pwd->pw_gid, groups, &ngroups); if (status < 1) { perror("Unable to get group list for user"); exit(1); } status = setgroups(ngroups, groups); if (status != 0) { perror("Unable to set group list for user"); exit(1); } status = setgid(pwd->pw_gid); if (status < 0) { fprintf(stderr, "Failed to set gid=%u(user=%s): %s\n", pwd->pw_gid, user, strerror(errno)); exit(1); } status = setuid(pwd->pw_uid); if (status < 0) { fprintf(stderr, "Failed to set uid=%u(user=%s): %s\n", pwd->pw_uid, user, strerror(errno)); exit(1); } } else if (!memcmp("--decode=", argv[i], 9)) { unsigned long long value; unsigned cap; const char *sep = ""; /* Note, if capabilities become longer than 64-bits we'll need to fixup the following code.. */ value = strtoull(argv[i]+9, NULL, 16); printf("0x%016llx=", value); for (cap=0; (cap < 64) && (value >> cap); ++cap) { if (value & (1ULL << cap)) { char *ptr; ptr = cap_to_name(cap); if (ptr != NULL) { printf("%s%s", sep, ptr); cap_free(ptr); } else { printf("%s%u", sep, cap); } sep = ","; } } printf("\n"); } else if (!memcmp("--supports=", argv[i], 11)) {