6 files changed, 313 insertions, 43 deletions

diff --git a/security/Kconfig b/security/Kconfig
index a94ee94cf491..8086e61058e3 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -80,6 +80,16 @@ config SECURITY_CAPABILITIES
           This enables the "default" Linux capabilities functionality.
           If you are unsure how to answer this question, answer Y.
 
+config SECURITY_FILE_CAPABILITIES
+        bool "File POSIX Capabilities (EXPERIMENTAL)"
+        depends on (SECURITY=n || SECURITY_CAPABILITIES!=n) && EXPERIMENTAL
+        default n
+        help
+          This enables filesystem capabilities, allowing you to give
+          binaries a subset of root's powers without using setuid 0.
+
+          If in doubt, answer N.
+
 config SECURITY_ROOTPLUG
         bool "Root Plug Support"
         depends on USB=y && SECURITY
diff --git a/security/capability.c b/security/capability.c
index fda6a14cb24d..9e99f36a8b5c 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -37,7 +37,13 @@ static struct security_operations capability_ops = {
 
         .inode_setxattr =               cap_inode_setxattr,
         .inode_removexattr =            cap_inode_removexattr,
+        .inode_need_killpriv =          cap_inode_need_killpriv,
+        .inode_killpriv =               cap_inode_killpriv,
 
+        .task_kill =                    cap_task_kill,
+        .task_setscheduler =            cap_task_setscheduler,
+        .task_setioprio =               cap_task_setioprio,
+        .task_setnice =                 cap_task_setnice,
         .task_post_setuid =             cap_task_post_setuid,
         .task_reparent_to_init =        cap_task_reparent_to_init,
 
diff --git a/security/commoncap.c b/security/commoncap.c
index 0f8a2ce3f3a6..afca6dd4ae69 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -22,6 +22,7 @@
 #include <linux/ptrace.h>
 #include <linux/xattr.h>
 #include <linux/hugetlb.h>
+#include <linux/mount.h>
 
 int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
 {
@@ -108,14 +109,130 @@ void cap_capset_set (struct task_struct *target, kernel_cap_t *effective,
         target->cap_permitted = *permitted;
 }
 
+static inline void bprm_clear_caps(struct linux_binprm *bprm)
+{
+        cap_clear(bprm->cap_inheritable);
+        cap_clear(bprm->cap_permitted);
+        bprm->cap_effective = false;
+}
+
+#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
+
+int cap_inode_need_killpriv(struct dentry *dentry)
+{
+        struct inode *inode = dentry->d_inode;
+        int error;
+
+        if (!inode->i_op || !inode->i_op->getxattr)
+               return 0;
+
+        error = inode->i_op->getxattr(dentry, XATTR_NAME_CAPS, NULL, 0);
+        if (error <= 0)
+                return 0;
+        return 1;
+}
+
+int cap_inode_killpriv(struct dentry *dentry)
+{
+        struct inode *inode = dentry->d_inode;
+
+        if (!inode->i_op || !inode->i_op->removexattr)
+               return 0;
+
+        return inode->i_op->removexattr(dentry, XATTR_NAME_CAPS);
+}
+
+static inline int cap_from_disk(__le32 *caps, struct linux_binprm *bprm,
+                                int size)
+{
+        __u32 magic_etc;
+
+        if (size != XATTR_CAPS_SZ)
+                return -EINVAL;
+
+        magic_etc = le32_to_cpu(caps[0]);
+
+        switch ((magic_etc & VFS_CAP_REVISION_MASK)) {
+        case VFS_CAP_REVISION:
+                if (magic_etc & VFS_CAP_FLAGS_EFFECTIVE)
+                        bprm->cap_effective = true;
+                else
+                        bprm->cap_effective = false;
+                bprm->cap_permitted = to_cap_t( le32_to_cpu(caps[1]) );
+                bprm->cap_inheritable = to_cap_t( le32_to_cpu(caps[2]) );
+                return 0;
+        default:
+                return -EINVAL;
+        }
+}
+
+/* Locate any VFS capabilities: */
+static int get_file_caps(struct linux_binprm *bprm)
+{
+        struct dentry *dentry;
+        int rc = 0;
+        __le32 v1caps[XATTR_CAPS_SZ];
+        struct inode *inode;
+
+        if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID) {
+                bprm_clear_caps(bprm);
+                return 0;
+        }
+
+        dentry = dget(bprm->file->f_dentry);
+        inode = dentry->d_inode;
+        if (!inode->i_op || !inode->i_op->getxattr)
+                goto out;
+
+        rc = inode->i_op->getxattr(dentry, XATTR_NAME_CAPS, &v1caps,
+                                                        XATTR_CAPS_SZ);
+        if (rc == -ENODATA || rc == -EOPNOTSUPP) {
+                /* no data, that's ok */
+                rc = 0;
+                goto out;
+        }
+        if (rc < 0)
+                goto out;
+
+        rc = cap_from_disk(v1caps, bprm, rc);
+        if (rc)
+                printk(KERN_NOTICE "%s: cap_from_disk returned %d for %s\n",
+                        __FUNCTION__, rc, bprm->filename);
+
+out:
+        dput(dentry);
+        if (rc)
+                bprm_clear_caps(bprm);
+
+        return rc;
+}
+
+#else
+int cap_inode_need_killpriv(struct dentry *dentry)
+{
+        return 0;
+}
+
+int cap_inode_killpriv(struct dentry *dentry)
+{
+        return 0;
+}
+
+static inline int get_file_caps(struct linux_binprm *bprm)
+{
+        bprm_clear_caps(bprm);
+        return 0;
+}
+#endif
+
 int cap_bprm_set_security (struct linux_binprm *bprm)
 {
-        /* Copied from fs/exec.c:prepare_binprm. */
+        int ret;
 
-        /* We don't have VFS support for capabilities yet */
-        cap_clear (bprm->cap_inheritable);
-        cap_clear (bprm->cap_permitted);
-        cap_clear (bprm->cap_effective);
+        ret = get_file_caps(bprm);
+        if (ret)
+                printk(KERN_NOTICE "%s: get_file_caps returned %d for %s\n",
+                        __FUNCTION__, ret, bprm->filename);
 
         /*  To support inheritance of root-permissions and suid-root
          *  executables under compatibility mode, we raise all three
@@ -131,9 +248,10 @@ int cap_bprm_set_security (struct linux_binprm *bprm)
                         cap_set_full (bprm->cap_permitted);
                 }
                 if (bprm->e_uid == 0)
-                        cap_set_full (bprm->cap_effective);
+                        bprm->cap_effective = true;
         }
-        return 0;
+
+        return ret;
 }
 
 void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
@@ -149,6 +267,7 @@ void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
         if (bprm->e_uid != current->uid || bprm->e_gid != current->gid ||
             !cap_issubset (new_permitted, current->cap_permitted)) {
                 set_dumpable(current->mm, suid_dumpable);
+                current->pdeath_signal = 0;
 
                 if (unsafe & ~LSM_UNSAFE_PTRACE_CAP) {
                         if (!capable(CAP_SETUID)) {
@@ -170,8 +289,8 @@ void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
          * capability rules */
         if (!is_init(current)) {
                 current->cap_permitted = new_permitted;
-                current->cap_effective =
-                    cap_intersect (new_permitted, bprm->cap_effective);
+                current->cap_effective = bprm->cap_effective ?
+                                new_permitted : 0;
         }
 
         /* AUD: Audit candidate if current->cap_effective is set */
@@ -181,11 +300,15 @@ void cap_bprm_apply_creds (struct linux_binprm *bprm, int unsafe)
 
 int cap_bprm_secureexec (struct linux_binprm *bprm)
 {
-        /* If/when this module is enhanced to incorporate capability
-           bits on files, the test below should be extended to also perform a 
-           test between the old and new capability sets.  For now,
-           it simply preserves the legacy decision algorithm used by
-           the old userland. */
+        if (current->uid != 0) {
+                if (bprm->cap_effective)
+                        return 1;
+                if (!cap_isclear(bprm->cap_permitted))
+                        return 1;
+                if (!cap_isclear(bprm->cap_inheritable))
+                        return 1;
+        }
+
         return (current->euid != current->uid ||
                 current->egid != current->gid);
 }
@@ -193,7 +316,11 @@ int cap_bprm_secureexec (struct linux_binprm *bprm)
 int cap_inode_setxattr(struct dentry *dentry, char *name, void *value,
                        size_t size, int flags)
 {
-        if (!strncmp(name, XATTR_SECURITY_PREFIX,
+        if (!strcmp(name, XATTR_NAME_CAPS)) {
+                if (!capable(CAP_SETFCAP))
+                        return -EPERM;
+                return 0;
+        } else if (!strncmp(name, XATTR_SECURITY_PREFIX,
                      sizeof(XATTR_SECURITY_PREFIX) - 1)  &&
             !capable(CAP_SYS_ADMIN))
                 return -EPERM;
@@ -202,7 +329,11 @@ int cap_inode_setxattr(struct dentry *dentry, char *name, void *value,
 
 int cap_inode_removexattr(struct dentry *dentry, char *name)
 {
-        if (!strncmp(name, XATTR_SECURITY_PREFIX,
+        if (!strcmp(name, XATTR_NAME_CAPS)) {
+                if (!capable(CAP_SETFCAP))
+                        return -EPERM;
+                return 0;
+        } else if (!strncmp(name, XATTR_SECURITY_PREFIX,
                      sizeof(XATTR_SECURITY_PREFIX) - 1)  &&
             !capable(CAP_SYS_ADMIN))
                 return -EPERM;
@@ -299,6 +430,83 @@ int cap_task_post_setuid (uid_t old_ruid, uid_t old_euid, uid_t old_suid,
         return 0;
 }
 
+#ifdef CONFIG_SECURITY_FILE_CAPABILITIES
+/*
+ * Rationale: code calling task_setscheduler, task_setioprio, and
+ * task_setnice, assumes that
+ *   . if capable(cap_sys_nice), then those actions should be allowed
+ *   . if not capable(cap_sys_nice), but acting on your own processes,
+ *      then those actions should be allowed
+ * This is insufficient now since you can call code without suid, but
+ * yet with increased caps.
+ * So we check for increased caps on the target process.
+ */
+static inline int cap_safe_nice(struct task_struct *p)
+{
+        if (!cap_issubset(p->cap_permitted, current->cap_permitted) &&
+            !__capable(current, CAP_SYS_NICE))
+                return -EPERM;
+        return 0;
+}
+
+int cap_task_setscheduler (struct task_struct *p, int policy,
+                           struct sched_param *lp)
+{
+        return cap_safe_nice(p);
+}
+
+int cap_task_setioprio (struct task_struct *p, int ioprio)
+{
+        return cap_safe_nice(p);
+}
+
+int cap_task_setnice (struct task_struct *p, int nice)
+{
+        return cap_safe_nice(p);
+}
+
+int cap_task_kill(struct task_struct *p, struct siginfo *info,
+                                int sig, u32 secid)
+{
+        if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
+                return 0;
+
+        if (secid)
+                /*
+                 * Signal sent as a particular user.
+                 * Capabilities are ignored.  May be wrong, but it's the
+                 * only thing we can do at the moment.
+                 * Used only by usb drivers?
+                 */
+                return 0;
+        if (cap_issubset(p->cap_permitted, current->cap_permitted))
+                return 0;
+        if (capable(CAP_KILL))
+                return 0;
+
+        return -EPERM;
+}
+#else
+int cap_task_setscheduler (struct task_struct *p, int policy,
+                           struct sched_param *lp)
+{
+        return 0;
+}
+int cap_task_setioprio (struct task_struct *p, int ioprio)
+{
+        return 0;
+}
+int cap_task_setnice (struct task_struct *p, int nice)
+{
+        return 0;
+}
+int cap_task_kill(struct task_struct *p, struct siginfo *info,
+                                int sig, u32 secid)
+{
+        return 0;
+}
+#endif
+
 void cap_task_reparent_to_init (struct task_struct *p)
 {
         p->cap_effective = CAP_INIT_EFF_SET;
@@ -336,6 +544,10 @@ EXPORT_SYMBOL(cap_bprm_secureexec);
 EXPORT_SYMBOL(cap_inode_setxattr);
 EXPORT_SYMBOL(cap_inode_removexattr);
 EXPORT_SYMBOL(cap_task_post_setuid);
+EXPORT_SYMBOL(cap_task_kill);
+EXPORT_SYMBOL(cap_task_setscheduler);
+EXPORT_SYMBOL(cap_task_setioprio);
+EXPORT_SYMBOL(cap_task_setnice);
 EXPORT_SYMBOL(cap_task_reparent_to_init);
 EXPORT_SYMBOL(cap_syslog);
 EXPORT_SYMBOL(cap_vm_enough_memory);
diff --git a/security/dummy.c b/security/dummy.c
index 4129dcf3daec..c77dec822385 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -376,6 +376,16 @@ static int dummy_inode_removexattr (struct dentry *dentry, char *name)
         return 0;
 }
 
+static int dummy_inode_need_killpriv(struct dentry *dentry)
+{
+        return 0;
+}
+
+static int dummy_inode_killpriv(struct dentry *dentry)
+{
+        return 0;
+}
+
 static int dummy_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
 {
         return -EOPNOTSUPP;
@@ -1022,6 +1032,8 @@ void security_fixup_ops (struct security_operations *ops)
         set_to_dummy_if_null(ops, inode_getxattr);
         set_to_dummy_if_null(ops, inode_listxattr);
         set_to_dummy_if_null(ops, inode_removexattr);
+        set_to_dummy_if_null(ops, inode_need_killpriv);
+        set_to_dummy_if_null(ops, inode_killpriv);
         set_to_dummy_if_null(ops, inode_xattr_getsuffix);
         set_to_dummy_if_null(ops, inode_getsecurity);
         set_to_dummy_if_null(ops, inode_setsecurity);
diff --git a/security/security.c b/security/security.c
index 5b1c034815a8..2e1b35dd2550 100644
--- a/security/security.c
+++ b/security/security.c
@@ -518,6 +518,16 @@ int security_inode_removexattr(struct dentry *dentry, char *name)
         return security_ops->inode_removexattr(dentry, name);
 }
 
+int security_inode_need_killpriv(struct dentry *dentry)
+{
+        return security_ops->inode_need_killpriv(dentry);
+}
+
+int security_inode_killpriv(struct dentry *dentry)
+{
+        return security_ops->inode_killpriv(dentry);
+}
+
 const char *security_inode_xattr_getsuffix(void)
 {
         return security_ops->inode_xattr_getsuffix();
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 83a535b7bc60..221def6a0b1d 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2297,6 +2297,25 @@ static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
 }
 
+static int selinux_inode_setotherxattr(struct dentry *dentry, char *name)
+{
+        if (!strncmp(name, XATTR_SECURITY_PREFIX,
+                     sizeof XATTR_SECURITY_PREFIX - 1)) {
+                if (!strcmp(name, XATTR_NAME_CAPS)) {
+                        if (!capable(CAP_SETFCAP))
+                                return -EPERM;
+                } else if (!capable(CAP_SYS_ADMIN)) {
+                        /* A different attribute in the security namespace.
+                           Restrict to administrator. */
+                        return -EPERM;
+                }
+        }
+
+        /* Not an attribute we recognize, so just check the
+           ordinary setattr permission. */
+        return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
+}
+
 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
 {
         struct task_security_struct *tsec = current->security;
@@ -2307,19 +2326,8 @@ static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value
         u32 newsid;
         int rc = 0;
 
-        if (strcmp(name, XATTR_NAME_SELINUX)) {
-                if (!strncmp(name, XATTR_SECURITY_PREFIX,
-                             sizeof XATTR_SECURITY_PREFIX - 1) &&
-                    !capable(CAP_SYS_ADMIN)) {
-                        /* A different attribute in the security namespace.
-                           Restrict to administrator. */
-                        return -EPERM;
-                }
-
-                /* Not an attribute we recognize, so just check the
-                   ordinary setattr permission. */
-                return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
-        }
+        if (strcmp(name, XATTR_NAME_SELINUX))
+                return selinux_inode_setotherxattr(dentry, name);
 
         sbsec = inode->i_sb->s_security;
         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
@@ -2393,20 +2401,8 @@ static int selinux_inode_listxattr (struct dentry *dentry)
 
 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
 {
-        if (strcmp(name, XATTR_NAME_SELINUX)) {
-                if (!strncmp(name, XATTR_SECURITY_PREFIX,
-                             sizeof XATTR_SECURITY_PREFIX - 1) &&
-                    !capable(CAP_SYS_ADMIN)) {
-                        /* A different attribute in the security namespace.
-                           Restrict to administrator. */
-                        return -EPERM;
-                }
-
-                /* Not an attribute we recognize, so just check the
-                   ordinary setattr permission. Might want a separate
-                   permission for removexattr. */
-                return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
-        }
+        if (strcmp(name, XATTR_NAME_SELINUX))
+                return selinux_inode_setotherxattr(dentry, name);
 
         /* No one is allowed to remove a SELinux security label.
            You can change the label, but all data must be labeled. */
@@ -2464,6 +2460,16 @@ static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t
         return len;
 }
 
+static int selinux_inode_need_killpriv(struct dentry *dentry)
+{
+        return secondary_ops->inode_need_killpriv(dentry);
+}
+
+static int selinux_inode_killpriv(struct dentry *dentry)
+{
+        return secondary_ops->inode_killpriv(dentry);
+}
+
 /* file security operations */
 
 static int selinux_revalidate_file_permission(struct file *file, int mask)
@@ -2882,6 +2888,12 @@ static int selinux_task_setnice(struct task_struct *p, int nice)
 
 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
 {
+        int rc;
+
+        rc = secondary_ops->task_setioprio(p, ioprio);
+        if (rc)
+                return rc;
+
         return task_has_perm(current, p, PROCESS__SETSCHED);
 }
 
@@ -2911,6 +2923,12 @@ static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim
 
 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
 {
+        int rc;
+
+        rc = secondary_ops->task_setscheduler(p, policy, lp);
+        if (rc)
+                return rc;
+
         return task_has_perm(current, p, PROCESS__SETSCHED);
 }
 
@@ -4830,6 +4848,8 @@ static struct security_operations selinux_ops = {
         .inode_getsecurity =            selinux_inode_getsecurity,
         .inode_setsecurity =            selinux_inode_setsecurity,
         .inode_listsecurity =           selinux_inode_listsecurity,
+        .inode_need_killpriv =          selinux_inode_need_killpriv,
+        .inode_killpriv =               selinux_inode_killpriv,
 
         .file_permission =              selinux_file_permission,
         .file_alloc_security =          selinux_file_alloc_security,