capabilities: implement per-process securebits

Filesystem capability support makes it possible to do away with (set)uid-0
based privilege and use capabilities instead.  That is, with filesystem
support for capabilities but without this present patch, it is (conceptually)
possible to manage a system with capabilities alone and never need to obtain
privilege via (set)uid-0.

Of course, conceptually isn't quite the same as currently possible since few
user applications, certainly not enough to run a viable system, are currently
prepared to leverage capabilities to exercise privilege.  Further, many
applications exist that may never get upgraded in this way, and the kernel
will continue to want to support their setuid-0 base privilege needs.

Where pure-capability applications evolve and replace setuid-0 binaries, it is
desirable that there be a mechanisms by which they can contain their
privilege.  In addition to leveraging the per-process bounding and inheritable
sets, this should include suppressing the privilege of the uid-0 superuser
from the process' tree of children.

The feature added by this patch can be leveraged to suppress the privilege
associated with (set)uid-0.  This suppression requires CAP_SETPCAP to
initiate, and only immediately affects the 'current' process (it is inherited
through fork()/exec()).  This reimplementation differs significantly from the
historical support for securebits which was system-wide, unwieldy and which
has ultimately withered to a dead relic in the source of the modern kernel.

With this patch applied a process, that is capable(CAP_SETPCAP), can now drop
all legacy privilege (through uid=0) for itself and all subsequently
fork()'d/exec()'d children with:

  prctl(PR_SET_SECUREBITS, 0x2f);

This patch represents a no-op unless CONFIG_SECURITY_FILE_CAPABILITIES is
enabled at configure time.

[akpm@linux-foundation.org: fix uninitialised var warning]
[serue@us.ibm.com: capabilities: use cap_task_prctl when !CONFIG_SECURITY]
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Reviewed-by: James Morris <jmorris@namei.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Paul Moore <paul.moore@hp.com>
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

5 files changed, 101 insertions, 14 deletions

diff --git a/security/capability.c b/security/capability.c
index 2c6e06d18fab..38ac54e3aed1 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -44,6 +44,7 @@ static struct security_operations capability_ops = {
         .task_setioprio =               cap_task_setioprio,
         .task_setnice =                 cap_task_setnice,
         .task_post_setuid =             cap_task_post_setuid,
+        .task_prctl =                   cap_task_prctl,
         .task_reparent_to_init =        cap_task_reparent_to_init,
 
         .syslog =                       cap_syslog,
diff --git a/security/commoncap.c b/security/commoncap.c
index 852905789caf..e8c3f5e46705 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -24,11 +24,8 @@
 #include <linux/hugetlb.h>
 #include <linux/mount.h>
 #include <linux/sched.h>
-
-/* Global security state */
-
-unsigned securebits = SECUREBITS_DEFAULT; /* systemwide security settings */
-EXPORT_SYMBOL(securebits);
+#include <linux/prctl.h>
+#include <linux/securebits.h>
 
 int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
 {
@@ -368,7 +365,7 @@ void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
 
         /* AUD: Audit candidate if current->cap_effective is set */
 
-        current->keep_capabilities = 0;
+        current->securebits &= ~issecure_mask(SECURE_KEEP_CAPS);
 }
 
 int cap_bprm_secureexec (struct linux_binprm *bprm)
@@ -448,7 +445,7 @@ static inline void cap_emulate_setxuid (int old_ruid, int old_euid,
 {
         if ((old_ruid == 0 || old_euid == 0 || old_suid == 0) &&
             (current->uid != 0 && current->euid != 0 && current->suid != 0) &&
-            !current->keep_capabilities) {
+            !issecure(SECURE_KEEP_CAPS)) {
                 cap_clear (current->cap_permitted);
                 cap_clear (current->cap_effective);
         }
@@ -547,7 +544,7 @@ int cap_task_setnice (struct task_struct *p, int nice)
  * this task could get inconsistent info.  There can be no
  * racing writer bc a task can only change its own caps.
  */
-long cap_prctl_drop(unsigned long cap)
+static long cap_prctl_drop(unsigned long cap)
 {
         if (!capable(CAP_SETPCAP))
                 return -EPERM;
@@ -556,6 +553,7 @@ long cap_prctl_drop(unsigned long cap)
         cap_lower(current->cap_bset, cap);
         return 0;
 }
+
 #else
 int cap_task_setscheduler (struct task_struct *p, int policy,
                            struct sched_param *lp)
@@ -572,12 +570,99 @@ int cap_task_setnice (struct task_struct *p, int nice)
 }
 #endif
 
+int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
+                   unsigned long arg4, unsigned long arg5, long *rc_p)
+{
+        long error = 0;
+
+        switch (option) {
+        case PR_CAPBSET_READ:
+                if (!cap_valid(arg2))
+                        error = -EINVAL;
+                else
+                        error = !!cap_raised(current->cap_bset, arg2);
+                break;
+#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
+        case PR_CAPBSET_DROP:
+                error = cap_prctl_drop(arg2);
+                break;
+
+        /*
+         * The next four prctl's remain to assist with transitioning a
+         * system from legacy UID=0 based privilege (when filesystem
+         * capabilities are not in use) to a system using filesystem
+         * capabilities only - as the POSIX.1e draft intended.
+         *
+         * Note:
+         *
+         *  PR_SET_SECUREBITS =
+         *      issecure_mask(SECURE_KEEP_CAPS_LOCKED)
+         *    | issecure_mask(SECURE_NOROOT)
+         *    | issecure_mask(SECURE_NOROOT_LOCKED)
+         *    | issecure_mask(SECURE_NO_SETUID_FIXUP)
+         *    | issecure_mask(SECURE_NO_SETUID_FIXUP_LOCKED)
+         *
+         * will ensure that the current process and all of its
+         * children will be locked into a pure
+         * capability-based-privilege environment.
+         */
+        case PR_SET_SECUREBITS:
+                if ((((current->securebits & SECURE_ALL_LOCKS) >> 1)
+                     & (current->securebits ^ arg2))                  /*[1]*/
+                    || ((current->securebits & SECURE_ALL_LOCKS
+                         & ~arg2))                                    /*[2]*/
+                    || (arg2 & ~(SECURE_ALL_LOCKS | SECURE_ALL_BITS)) /*[3]*/
+                    || (cap_capable(current, CAP_SETPCAP) != 0)) {    /*[4]*/
+                        /*
+                         * [1] no changing of bits that are locked
+                         * [2] no unlocking of locks
+                         * [3] no setting of unsupported bits
+                         * [4] doing anything requires privilege (go read about
+                         *     the "sendmail capabilities bug")
+                         */
+                        error = -EPERM;  /* cannot change a locked bit */
+                } else {
+                        current->securebits = arg2;
+                }
+                break;
+        case PR_GET_SECUREBITS:
+                error = current->securebits;
+                break;
+
+#endif /* def CONFIG_SECURITY_FILE_CAPABILITIES */
+
+        case PR_GET_KEEPCAPS:
+                if (issecure(SECURE_KEEP_CAPS))
+                        error = 1;
+                break;
+        case PR_SET_KEEPCAPS:
+                if (arg2 > 1) /* Note, we rely on arg2 being unsigned here */
+                        error = -EINVAL;
+                else if (issecure(SECURE_KEEP_CAPS_LOCKED))
+                        error = -EPERM;
+                else if (arg2)
+                        current->securebits |= issecure_mask(SECURE_KEEP_CAPS);
+                else
+                        current->securebits &=
+                                ~issecure_mask(SECURE_KEEP_CAPS);
+                break;
+
+        default:
+                /* No functionality available - continue with default */
+                return 0;
+        }
+
+        /* Functionality provided */
+        *rc_p = error;
+        return 1;
+}
+
 void cap_task_reparent_to_init (struct task_struct *p)
 {
         cap_set_init_eff(p->cap_effective);
         cap_clear(p->cap_inheritable);
         cap_set_full(p->cap_permitted);
-        p->keep_capabilities = 0;
+        p->securebits = SECUREBITS_DEFAULT;
         return;
 }
 
diff --git a/security/dummy.c b/security/dummy.c
index b0232bbf427b..58d4dd1af5c7 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -604,7 +604,7 @@ static int dummy_task_kill (struct task_struct *p, struct siginfo *info,
 }
 
 static int dummy_task_prctl (int option, unsigned long arg2, unsigned long arg3,
-                             unsigned long arg4, unsigned long arg5)
+                             unsigned long arg4, unsigned long arg5, long *rc_p)
 {
         return 0;
 }
diff --git a/security/security.c b/security/security.c
index 8a285c7b9962..d5cb5898d967 100644
--- a/security/security.c
+++ b/security/security.c
@@ -733,9 +733,9 @@ int security_task_wait(struct task_struct *p)
 }
 
 int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
-                         unsigned long arg4, unsigned long arg5)
+                         unsigned long arg4, unsigned long arg5, long *rc_p)
 {
-        return security_ops->task_prctl(option, arg2, arg3, arg4, arg5);
+        return security_ops->task_prctl(option, arg2, arg3, arg4, arg5, rc_p);
 }
 
 void security_task_reparent_to_init(struct task_struct *p)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 308e2cf17d75..04acb5af8317 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3303,12 +3303,13 @@ static int selinux_task_prctl(int option,
                               unsigned long arg2,
                               unsigned long arg3,
                               unsigned long arg4,
-                              unsigned long arg5)
+                              unsigned long arg5,
+                              long *rc_p)
 {
         /* The current prctl operations do not appear to require
            any SELinux controls since they merely observe or modify
            the state of the current process. */
-        return 0;
+        return secondary_ops->task_prctl(option, arg2, arg3, arg4, arg5, rc_p);
 }
 
 static int selinux_task_wait(struct task_struct *p)