2 * Copyright (c) 2008-2011 Robert N. M. Watson
3 * Copyright (c) 2010-2011 Jonathan Anderson
4 * Copyright (c) 2012 FreeBSD Foundation
7 * This software was developed at the University of Cambridge Computer
8 * Laboratory with support from a grant from Google, Inc.
10 * Portions of this software were developed by Pawel Jakub Dawidek under
11 * sponsorship from the FreeBSD Foundation.
13 * Redistribution and use in source and binary forms, with or without
14 * modification, are permitted provided that the following conditions
16 * 1. Redistributions of source code must retain the above copyright
17 * notice, this list of conditions and the following disclaimer.
18 * 2. Redistributions in binary form must reproduce the above copyright
19 * notice, this list of conditions and the following disclaimer in the
20 * documentation and/or other materials provided with the distribution.
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 * FreeBSD kernel capability facility.
38 * Two kernel features are implemented here: capability mode, a sandboxed mode
39 * of execution for processes, and capabilities, a refinement on file
40 * descriptors that allows fine-grained control over operations on the file
41 * descriptor. Collectively, these allow processes to run in the style of a
42 * historic "capability system" in which they can use only resources
43 * explicitly delegated to them. This model is enforced by restricting access
44 * to global namespaces in capability mode.
46 * Capabilities wrap other file descriptor types, binding them to a constant
47 * rights mask set when the capability is created. New capabilities may be
48 * derived from existing capabilities, but only if they have the same or a
49 * strict subset of the rights on the original capability.
51 * System calls permitted in capability mode are defined in capabilities.conf;
52 * calls must be carefully audited for safety to ensure that they don't allow
53 * escape from a sandbox. Some calls permit only a subset of operations in
54 * capability mode -- for example, shm_open(2) is limited to creating
55 * anonymous, rather than named, POSIX shared memory objects.
58 #include <sys/cdefs.h>
59 __FBSDID("$FreeBSD$");
61 #include "opt_capsicum.h"
62 #include "opt_ktrace.h"
64 #include <sys/param.h>
65 #include <sys/capsicum.h>
67 #include <sys/filedesc.h>
68 #include <sys/kernel.h>
69 #include <sys/limits.h>
71 #include <sys/mutex.h>
73 #include <sys/syscallsubr.h>
74 #include <sys/sysproto.h>
75 #include <sys/sysctl.h>
76 #include <sys/systm.h>
77 #include <sys/ucred.h>
79 #include <sys/ktrace.h>
81 #include <security/audit/audit.h>
87 SYSCTL_INT(_kern, OID_AUTO, trap_enotcap, CTLFLAG_RW, &trap_enotcap, 0,
88 "Deliver SIGTRAP on ENOTCAPABLE");
90 #ifdef CAPABILITY_MODE
92 FEATURE(security_capability_mode, "Capsicum Capability Mode");
95 * System call to enter capability mode for the process.
98 sys_cap_enter(struct thread *td, struct cap_enter_args *uap)
100 struct ucred *newcred, *oldcred;
103 if (IN_CAPABILITY_MODE(td))
109 oldcred = crcopysafe(p, newcred);
110 newcred->cr_flags |= CRED_FLAG_CAPMODE;
111 proc_set_cred(p, newcred);
118 * System call to query whether the process is in capability mode.
121 sys_cap_getmode(struct thread *td, struct cap_getmode_args *uap)
125 i = IN_CAPABILITY_MODE(td) ? 1 : 0;
126 return (copyout(&i, uap->modep, sizeof(i)));
129 #else /* !CAPABILITY_MODE */
132 sys_cap_enter(struct thread *td, struct cap_enter_args *uap)
139 sys_cap_getmode(struct thread *td, struct cap_getmode_args *uap)
145 #endif /* CAPABILITY_MODE */
149 FEATURE(security_capabilities, "Capsicum Capabilities");
151 MALLOC_DECLARE(M_FILECAPS);
154 _cap_check(const cap_rights_t *havep, const cap_rights_t *needp,
155 enum ktr_cap_fail_type type)
158 if (!cap_rights_contains(havep, needp)) {
160 if (KTRPOINT(curthread, KTR_CAPFAIL))
161 ktrcapfail(type, needp, havep);
163 return (ENOTCAPABLE);
169 * Test whether a capability grants the requested rights.
172 cap_check(const cap_rights_t *havep, const cap_rights_t *needp)
175 return (_cap_check(havep, needp, CAPFAIL_NOTCAPABLE));
179 * Convert capability rights into VM access flags.
182 cap_rights_to_vmprot(cap_rights_t *havep)
186 maxprot = VM_PROT_NONE;
187 if (cap_rights_is_set(havep, CAP_MMAP_R))
188 maxprot |= VM_PROT_READ;
189 if (cap_rights_is_set(havep, CAP_MMAP_W))
190 maxprot |= VM_PROT_WRITE;
191 if (cap_rights_is_set(havep, CAP_MMAP_X))
192 maxprot |= VM_PROT_EXECUTE;
198 * Extract rights from a capability for monitoring purposes -- not for use in
199 * any other way, as we want to keep all capability permission evaluation in
204 cap_rights_fde(struct filedescent *fde)
207 return (&fde->fde_rights);
211 cap_rights(struct filedesc *fdp, int fd)
214 return (cap_rights_fde(&fdp->fd_ofiles[fd]));
218 kern_cap_rights_limit(struct thread *td, int fd, cap_rights_t *rights)
220 struct filedesc *fdp;
223 fdp = td->td_proc->p_fd;
225 if (fget_locked(fdp, fd) == NULL) {
226 FILEDESC_XUNLOCK(fdp);
229 error = _cap_check(cap_rights(fdp, fd), rights, CAPFAIL_INCREASE);
231 fdp->fd_ofiles[fd].fde_rights = *rights;
232 if (!cap_rights_is_set(rights, CAP_IOCTL)) {
233 free(fdp->fd_ofiles[fd].fde_ioctls, M_FILECAPS);
234 fdp->fd_ofiles[fd].fde_ioctls = NULL;
235 fdp->fd_ofiles[fd].fde_nioctls = 0;
237 if (!cap_rights_is_set(rights, CAP_FCNTL))
238 fdp->fd_ofiles[fd].fde_fcntls = 0;
240 FILEDESC_XUNLOCK(fdp);
245 * System call to limit rights of the given capability.
248 sys_cap_rights_limit(struct thread *td, struct cap_rights_limit_args *uap)
253 cap_rights_init(&rights);
255 error = copyin(uap->rightsp, &rights, sizeof(rights.cr_rights[0]));
258 version = CAPVER(&rights);
259 if (version != CAP_RIGHTS_VERSION_00)
262 error = copyin(uap->rightsp, &rights,
263 sizeof(rights.cr_rights[0]) * CAPARSIZE(&rights));
266 /* Check for race. */
267 if (CAPVER(&rights) != version)
270 if (!cap_rights_is_valid(&rights))
273 if (version != CAP_RIGHTS_VERSION) {
274 rights.cr_rights[0] &= ~(0x3ULL << 62);
275 rights.cr_rights[0] |= ((uint64_t)CAP_RIGHTS_VERSION << 62);
278 if (KTRPOINT(td, KTR_STRUCT))
279 ktrcaprights(&rights);
282 AUDIT_ARG_FD(uap->fd);
283 AUDIT_ARG_RIGHTS(&rights);
284 return (kern_cap_rights_limit(td, uap->fd, &rights));
288 * System call to query the rights mask associated with a capability.
291 sys___cap_rights_get(struct thread *td, struct __cap_rights_get_args *uap)
293 struct filedesc *fdp;
297 if (uap->version != CAP_RIGHTS_VERSION_00)
304 fdp = td->td_proc->p_fd;
306 if (fget_locked(fdp, fd) == NULL) {
307 FILEDESC_SUNLOCK(fdp);
310 rights = *cap_rights(fdp, fd);
311 FILEDESC_SUNLOCK(fdp);
312 n = uap->version + 2;
313 if (uap->version != CAPVER(&rights)) {
315 * For older versions we need to check if the descriptor
316 * doesn't contain rights not understood by the caller.
317 * If it does, we have to return an error.
319 for (i = n; i < CAPARSIZE(&rights); i++) {
320 if ((rights.cr_rights[i] & ~(0x7FULL << 57)) != 0)
324 error = copyout(&rights, uap->rightsp, sizeof(rights.cr_rights[0]) * n);
326 if (error == 0 && KTRPOINT(td, KTR_STRUCT))
327 ktrcaprights(&rights);
333 * Test whether a capability grants the given ioctl command.
334 * If descriptor doesn't have CAP_IOCTL, then ioctls list is empty and
335 * ENOTCAPABLE will be returned.
338 cap_ioctl_check(struct filedesc *fdp, int fd, u_long cmd)
344 FILEDESC_LOCK_ASSERT(fdp);
345 KASSERT(fd >= 0 && fd < fdp->fd_nfiles,
346 ("%s: invalid fd=%d", __func__, fd));
348 ncmds = fdp->fd_ofiles[fd].fde_nioctls;
352 cmds = fdp->fd_ofiles[fd].fde_ioctls;
353 for (i = 0; i < ncmds; i++) {
358 return (ENOTCAPABLE);
362 * Check if the current ioctls list can be replaced by the new one.
365 cap_ioctl_limit_check(struct filedesc *fdp, int fd, const u_long *cmds,
373 oncmds = fdp->fd_ofiles[fd].fde_nioctls;
376 if (oncmds < (ssize_t)ncmds)
377 return (ENOTCAPABLE);
379 ocmds = fdp->fd_ofiles[fd].fde_ioctls;
380 for (i = 0; i < ncmds; i++) {
381 for (j = 0; j < oncmds; j++) {
382 if (cmds[i] == ocmds[j])
386 return (ENOTCAPABLE);
393 kern_cap_ioctls_limit(struct thread *td, int fd, u_long *cmds, size_t ncmds)
395 struct filedesc *fdp;
401 fdp = td->td_proc->p_fd;
404 if (fget_locked(fdp, fd) == NULL) {
409 error = cap_ioctl_limit_check(fdp, fd, cmds, ncmds);
413 ocmds = fdp->fd_ofiles[fd].fde_ioctls;
414 fdp->fd_ofiles[fd].fde_ioctls = cmds;
415 fdp->fd_ofiles[fd].fde_nioctls = ncmds;
420 FILEDESC_XUNLOCK(fdp);
421 free(cmds, M_FILECAPS);
426 sys_cap_ioctls_limit(struct thread *td, struct cap_ioctls_limit_args *uap)
434 if (ncmds > 256) /* XXX: Is 256 sane? */
440 cmds = malloc(sizeof(cmds[0]) * ncmds, M_FILECAPS, M_WAITOK);
441 error = copyin(uap->cmds, cmds, sizeof(cmds[0]) * ncmds);
443 free(cmds, M_FILECAPS);
448 return (kern_cap_ioctls_limit(td, uap->fd, cmds, ncmds));
452 sys_cap_ioctls_get(struct thread *td, struct cap_ioctls_get_args *uap)
454 struct filedesc *fdp;
455 struct filedescent *fdep;
462 maxcmds = uap->maxcmds;
466 fdp = td->td_proc->p_fd;
469 if (fget_locked(fdp, fd) == NULL) {
475 * If all ioctls are allowed (fde_nioctls == -1 && fde_ioctls == NULL)
476 * the only sane thing we can do is to not populate the given array and
477 * return CAP_IOCTLS_ALL.
480 fdep = &fdp->fd_ofiles[fd];
481 if (cmds != NULL && fdep->fde_ioctls != NULL) {
482 error = copyout(fdep->fde_ioctls, cmds,
483 sizeof(cmds[0]) * MIN(fdep->fde_nioctls, maxcmds));
487 if (fdep->fde_nioctls == -1)
488 td->td_retval[0] = CAP_IOCTLS_ALL;
490 td->td_retval[0] = fdep->fde_nioctls;
494 FILEDESC_SUNLOCK(fdp);
499 * Test whether a capability grants the given fcntl command.
502 cap_fcntl_check_fde(struct filedescent *fde, int cmd)
506 fcntlcap = (1 << cmd);
507 KASSERT((CAP_FCNTL_ALL & fcntlcap) != 0,
508 ("Unsupported fcntl=%d.", cmd));
510 if ((fde->fde_fcntls & fcntlcap) != 0)
513 return (ENOTCAPABLE);
517 cap_fcntl_check(struct filedesc *fdp, int fd, int cmd)
520 KASSERT(fd >= 0 && fd < fdp->fd_nfiles,
521 ("%s: invalid fd=%d", __func__, fd));
523 return (cap_fcntl_check_fde(&fdp->fd_ofiles[fd], cmd));
527 sys_cap_fcntls_limit(struct thread *td, struct cap_fcntls_limit_args *uap)
529 struct filedesc *fdp;
530 uint32_t fcntlrights;
534 fcntlrights = uap->fcntlrights;
537 AUDIT_ARG_FCNTL_RIGHTS(fcntlrights);
539 if ((fcntlrights & ~CAP_FCNTL_ALL) != 0)
542 fdp = td->td_proc->p_fd;
545 if (fget_locked(fdp, fd) == NULL) {
546 FILEDESC_XUNLOCK(fdp);
550 if ((fcntlrights & ~fdp->fd_ofiles[fd].fde_fcntls) != 0) {
551 FILEDESC_XUNLOCK(fdp);
552 return (ENOTCAPABLE);
555 fdp->fd_ofiles[fd].fde_fcntls = fcntlrights;
556 FILEDESC_XUNLOCK(fdp);
562 sys_cap_fcntls_get(struct thread *td, struct cap_fcntls_get_args *uap)
564 struct filedesc *fdp;
572 fdp = td->td_proc->p_fd;
574 if (fget_locked(fdp, fd) == NULL) {
575 FILEDESC_SUNLOCK(fdp);
578 rights = fdp->fd_ofiles[fd].fde_fcntls;
579 FILEDESC_SUNLOCK(fdp);
581 return (copyout(&rights, uap->fcntlrightsp, sizeof(rights)));
584 #else /* !CAPABILITIES */
587 * Stub Capability functions for when options CAPABILITIES isn't compiled
592 sys_cap_rights_limit(struct thread *td, struct cap_rights_limit_args *uap)
599 sys___cap_rights_get(struct thread *td, struct __cap_rights_get_args *uap)
606 sys_cap_ioctls_limit(struct thread *td, struct cap_ioctls_limit_args *uap)
613 sys_cap_ioctls_get(struct thread *td, struct cap_ioctls_get_args *uap)
620 sys_cap_fcntls_limit(struct thread *td, struct cap_fcntls_limit_args *uap)
627 sys_cap_fcntls_get(struct thread *td, struct cap_fcntls_get_args *uap)
633 #endif /* CAPABILITIES */