63#include "opt_capsicum.h"
64#include "opt_ktrace.h"
67#include <sys/capsicum.h>
69#include <sys/filedesc.h>
70#include <sys/kernel.h>
71#include <sys/limits.h>
75#include <sys/syscallsubr.h>
76#include <sys/sysproto.h>
77#include <sys/sysctl.h>
81#include <sys/ktrace.h>
83#include <security/audit/audit.h>
90 "Deliver SIGTRAP on ENOTCAPABLE");
94#define IOCTLS_MAX_COUNT 256
96FEATURE(security_capability_mode,
"Capsicum Capability Mode");
104 struct ucred *newcred, *oldcred;
107 if (IN_CAPABILITY_MODE(td))
114 newcred->cr_flags |= CRED_FLAG_CAPMODE;
129 i = IN_CAPABILITY_MODE(td) ? 1 : 0;
130 return (copyout(&i, uap->modep,
sizeof(i)));
153FEATURE(security_capabilities,
"Capsicum Capabilities");
158_cap_check(
const cap_rights_t *havep,
const cap_rights_t *needp,
159 enum ktr_cap_fail_type
type)
162 if (!cap_rights_contains(havep, needp)) {
164 if (KTRPOINT(curthread, KTR_CAPFAIL))
165 ktrcapfail(
type, needp, havep);
167 return (ENOTCAPABLE);
176cap_check(
const cap_rights_t *havep,
const cap_rights_t *needp)
179 return (_cap_check(havep, needp, CAPFAIL_NOTCAPABLE));
183cap_check_failed_notcapable(
const cap_rights_t *havep,
const cap_rights_t *needp)
187 if (KTRPOINT(curthread, KTR_CAPFAIL))
188 ktrcapfail(CAPFAIL_NOTCAPABLE, needp, havep);
190 return (ENOTCAPABLE);
197cap_rights_to_vmprot(
const cap_rights_t *havep)
201 maxprot = VM_PROT_NONE;
202 if (cap_rights_is_set(havep, CAP_MMAP_R))
203 maxprot |= VM_PROT_READ;
204 if (cap_rights_is_set(havep, CAP_MMAP_W))
205 maxprot |= VM_PROT_WRITE;
206 if (cap_rights_is_set(havep, CAP_MMAP_X))
207 maxprot |= VM_PROT_EXECUTE;
219cap_rights_fde(
const struct filedescent *fdep)
222 return (cap_rights_fde_inline(fdep));
226cap_rights(
struct filedesc *fdp,
int fd)
229 return (cap_rights_fde(&fdp->fd_ofiles[
fd]));
233kern_cap_rights_limit(
struct thread *td,
int fd, cap_rights_t *rights)
235 struct filedesc *fdp;
236 struct filedescent *fdep;
240 fdp = td->td_proc->p_fd;
242 fdep = fdeget_noref(fdp,
fd);
244 FILEDESC_XUNLOCK(fdp);
248 error = _cap_check(cap_rights(fdp,
fd), rights, CAPFAIL_INCREASE);
250 seqc_write_begin(&fdep->fde_seqc);
251 fdep->fde_rights = *rights;
252 if (!cap_rights_is_set(rights, CAP_IOCTL)) {
253 ioctls = fdep->fde_ioctls;
254 fdep->fde_ioctls = NULL;
255 fdep->fde_nioctls = 0;
257 if (!cap_rights_is_set(rights, CAP_FCNTL))
258 fdep->fde_fcntls = 0;
259 seqc_write_end(&fdep->fde_seqc);
261 FILEDESC_XUNLOCK(fdp);
262 free(ioctls, M_FILECAPS);
275 cap_rights_init_zero(&rights);
277 error = copyin(uap->rightsp, &rights,
sizeof(rights.cr_rights[0]));
280 version = CAPVER(&rights);
281 if (version != CAP_RIGHTS_VERSION_00)
284 error = copyin(uap->rightsp, &rights,
285 sizeof(rights.cr_rights[0]) * CAPARSIZE(&rights));
289 if (CAPVER(&rights) != version)
295 if (version != CAP_RIGHTS_VERSION) {
296 rights.cr_rights[0] &= ~(0x3ULL << 62);
297 rights.cr_rights[0] |= ((uint64_t)CAP_RIGHTS_VERSION << 62);
300 if (KTRPOINT(td, KTR_STRUCT))
301 ktrcaprights(&rights);
304 AUDIT_ARG_FD(uap->fd);
305 AUDIT_ARG_RIGHTS(&rights);
306 return (kern_cap_rights_limit(td, uap->fd, &rights));
315 struct filedesc *fdp;
319 if (uap->version != CAP_RIGHTS_VERSION_00)
326 fdp = td->td_proc->p_fd;
328 if (fget_noref(fdp,
fd) == NULL) {
329 FILEDESC_SUNLOCK(fdp);
332 rights = *cap_rights(fdp,
fd);
333 FILEDESC_SUNLOCK(fdp);
334 n = uap->version + 2;
335 if (uap->version != CAPVER(&rights)) {
341 for (i = n; i < CAPARSIZE(&rights); i++) {
342 if ((rights.cr_rights[i] & ~(0x7FULL << 57)) != 0)
346 error = copyout(&rights, uap->rightsp,
sizeof(rights.cr_rights[0]) * n);
348 if (error == 0 && KTRPOINT(td, KTR_STRUCT))
349 ktrcaprights(&rights);
360cap_ioctl_check(
struct filedesc *fdp,
int fd, u_long cmd)
362 struct filedescent *fdep;
367 KASSERT(
fd >= 0 && fd < fdp->fd_nfiles,
368 (
"%s: invalid fd=%d", __func__,
fd));
370 fdep = fdeget_noref(fdp,
fd);
371 KASSERT(fdep != NULL,
372 (
"%s: invalid fd=%d", __func__,
fd));
374 ncmds = fdep->fde_nioctls;
378 cmds = fdep->fde_ioctls;
379 for (i = 0; i < ncmds; i++) {
384 return (ENOTCAPABLE);
391cap_ioctl_limit_check(
struct filedescent *fdep,
const u_long *cmds,
399 oncmds = fdep->fde_nioctls;
402 if (oncmds < (ssize_t)ncmds)
403 return (ENOTCAPABLE);
405 ocmds = fdep->fde_ioctls;
406 for (i = 0; i < ncmds; i++) {
407 for (j = 0; j < oncmds; j++) {
408 if (cmds[i] == ocmds[j])
412 return (ENOTCAPABLE);
419kern_cap_ioctls_limit(
struct thread *td,
int fd, u_long *cmds,
size_t ncmds)
421 struct filedesc *fdp;
422 struct filedescent *fdep;
428 if (ncmds > IOCTLS_MAX_COUNT) {
433 fdp = td->td_proc->p_fd;
436 fdep = fdeget_noref(fdp,
fd);
442 error = cap_ioctl_limit_check(fdep, cmds, ncmds);
446 ocmds = fdep->fde_ioctls;
447 seqc_write_begin(&fdep->fde_seqc);
448 fdep->fde_ioctls = cmds;
449 fdep->fde_nioctls = ncmds;
450 seqc_write_end(&fdep->fde_seqc);
455 FILEDESC_XUNLOCK(fdp);
457 free(cmds, M_FILECAPS);
470 if (ncmds > IOCTLS_MAX_COUNT)
476 cmds =
malloc(
sizeof(cmds[0]) * ncmds, M_FILECAPS, M_WAITOK);
477 error = copyin(uap->cmds, cmds,
sizeof(cmds[0]) * ncmds);
479 free(cmds, M_FILECAPS);
484 return (kern_cap_ioctls_limit(td, uap->fd, cmds, ncmds));
490 struct filedesc *fdp;
491 struct filedescent *fdep;
492 u_long *cmdsp, *dstcmds;
493 size_t maxcmds, ncmds;
499 maxcmds = uap->maxcmds;
503 fdp = td->td_proc->p_fd;
506 if (dstcmds != NULL) {
507 cmdsp =
malloc(
sizeof(cmdsp[0]) * IOCTLS_MAX_COUNT, M_FILECAPS,
512 fdep = fdeget_noref(fdp,
fd);
515 FILEDESC_SUNLOCK(fdp);
518 count = fdep->fde_nioctls;
519 if (
count != -1 && cmdsp != NULL) {
520 ncmds = MIN(
count, maxcmds);
521 memcpy(cmdsp, fdep->fde_ioctls,
sizeof(cmdsp[0]) * ncmds);
523 FILEDESC_SUNLOCK(fdp);
532 error = copyout(cmdsp, dstcmds,
533 sizeof(cmdsp[0]) * ncmds);
537 td->td_retval[0] =
count;
539 td->td_retval[0] = CAP_IOCTLS_ALL;
544 free(cmdsp, M_FILECAPS);
552cap_fcntl_check_fde(
struct filedescent *fdep,
int cmd)
556 fcntlcap = (1 << cmd);
557 KASSERT((CAP_FCNTL_ALL & fcntlcap) != 0,
558 (
"Unsupported fcntl=%d.", cmd));
560 if ((fdep->fde_fcntls & fcntlcap) != 0)
563 return (ENOTCAPABLE);
567cap_fcntl_check(
struct filedesc *fdp,
int fd,
int cmd)
570 KASSERT(
fd >= 0 && fd < fdp->fd_nfiles,
571 (
"%s: invalid fd=%d", __func__,
fd));
573 return (cap_fcntl_check_fde(&fdp->fd_ofiles[
fd], cmd));
579 struct filedesc *fdp;
580 struct filedescent *fdep;
581 uint32_t fcntlrights;
585 fcntlrights = uap->fcntlrights;
588 AUDIT_ARG_FCNTL_RIGHTS(fcntlrights);
590 if ((fcntlrights & ~CAP_FCNTL_ALL) != 0)
593 fdp = td->td_proc->p_fd;
596 fdep = fdeget_noref(fdp,
fd);
598 FILEDESC_XUNLOCK(fdp);
602 if ((fcntlrights & ~fdep->fde_fcntls) != 0) {
603 FILEDESC_XUNLOCK(fdp);
604 return (ENOTCAPABLE);
607 seqc_write_begin(&fdep->fde_seqc);
608 fdep->fde_fcntls = fcntlrights;
609 seqc_write_end(&fdep->fde_seqc);
610 FILEDESC_XUNLOCK(fdp);
618 struct filedesc *fdp;
619 struct filedescent *fdep;
627 fdp = td->td_proc->p_fd;
629 fdep = fdeget_noref(fdp,
fd);
631 FILEDESC_SUNLOCK(fdp);
634 rights = fdep->fde_fcntls;
635 FILEDESC_SUNLOCK(fdp);
637 return (copyout(&rights, uap->fcntlrightsp,
sizeof(rights)));
device_property_type_t type
MALLOC_DECLARE(M_FADVISE)
FEATURE(kdtrace_hooks, "Kernel DTrace hooks which are required to load DTrace kernel modules")
void *() malloc(size_t size, struct malloc_type *mtp, int flags)
void free(void *addr, struct malloc_type *mtp)
struct ucred * crget(void)
void proc_set_cred(struct proc *p, struct ucred *newcred)
struct ucred * crcopysafe(struct proc *p, struct ucred *cr)
void crfree(struct ucred *cr)
bool cap_rights_is_valid(const cap_rights_t *rights)
int sys___cap_rights_get(struct thread *td, struct __cap_rights_get_args *uap)
int sys_cap_rights_limit(struct thread *td, struct cap_rights_limit_args *uap)
int sys_cap_getmode(struct thread *td, struct cap_getmode_args *uap)
int sys_cap_ioctls_limit(struct thread *td, struct cap_ioctls_limit_args *uap)
int sys_cap_fcntls_limit(struct thread *td, struct cap_fcntls_limit_args *uap)
bool __read_frequently trap_enotcap
SYSCTL_BOOL(_kern, OID_AUTO, trap_enotcap, CTLFLAG_RWTUN, &trap_enotcap, 0, "Deliver SIGTRAP on ENOTCAPABLE")
int sys_cap_ioctls_get(struct thread *td, struct cap_ioctls_get_args *uap)
int sys_cap_enter(struct thread *td, struct cap_enter_args *uap)
int sys_cap_fcntls_get(struct thread *td, struct cap_fcntls_get_args *uap)