[deliverable/linux.git] / include / linux / capability.h

/*
 * This is <linux/capability.h>
 *
 * Andrew G. Morgan <morgan@kernel.org>
 * Alexander Kjeldaas <astor@guardian.no>
 * with help from Aleph1, Roland Buresund and Andrew Main.
 *
 * See here for the libcap library ("POSIX draft" compliance):
 *
 * ftp://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.6/
 */
#ifndef _LINUX_CAPABILITY_H
#define _LINUX_CAPABILITY_H

#include <uapi/linux/capability.h>


#define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3
#define _KERNEL_CAPABILITY_U32S    _LINUX_CAPABILITY_U32S_3

extern int file_caps_enabled;

typedef struct kernel_cap_struct {
	__u32 cap[_KERNEL_CAPABILITY_U32S];
} kernel_cap_t;

/* exact same as vfs_cap_data but in cpu endian and always filled completely */
struct cpu_vfs_cap_data {
	__u32 magic_etc;
	kernel_cap_t permitted;
	kernel_cap_t inheritable;
};

#define _USER_CAP_HEADER_SIZE  (sizeof(struct __user_cap_header_struct))
#define _KERNEL_CAP_T_SIZE     (sizeof(kernel_cap_t))


struct file;
struct inode;
struct dentry;
struct user_namespace;

extern const kernel_cap_t __cap_empty_set;
extern const kernel_cap_t __cap_init_eff_set;

/*
 * Internal kernel functions only
 */

#define CAP_FOR_EACH_U32(__capi)  \
	for (__capi = 0; __capi < _KERNEL_CAPABILITY_U32S; ++__capi)

/*
 * CAP_FS_MASK and CAP_NFSD_MASKS:
 *
 * The fs mask is all the privileges that fsuid==0 historically meant.
 * At one time in the past, that included CAP_MKNOD and CAP_LINUX_IMMUTABLE.
 *
 * It has never meant setting security.* and trusted.* xattrs.
 *
 * We could also define fsmask as follows:
 *   1. CAP_FS_MASK is the privilege to bypass all fs-related DAC permissions
 *   2. The security.* and trusted.* xattrs are fs-related MAC permissions
 */

# define CAP_FS_MASK_B0     (CAP_TO_MASK(CAP_CHOWN)		\
			    | CAP_TO_MASK(CAP_MKNOD)		\
			    | CAP_TO_MASK(CAP_DAC_OVERRIDE)	\
			    | CAP_TO_MASK(CAP_DAC_READ_SEARCH)	\
			    | CAP_TO_MASK(CAP_FOWNER)		\
			    | CAP_TO_MASK(CAP_FSETID))

# define CAP_FS_MASK_B1     (CAP_TO_MASK(CAP_MAC_OVERRIDE))

#if _KERNEL_CAPABILITY_U32S != 2
# error Fix up hand-coded capability macro initializers
#else /* HAND-CODED capability initializers */

#define CAP_LAST_U32			((_KERNEL_CAPABILITY_U32S) - 1)
#define CAP_LAST_U32_VALID_MASK		(CAP_TO_MASK(CAP_LAST_CAP + 1) -1)

# define CAP_EMPTY_SET    ((kernel_cap_t){{ 0, 0 }})
# define CAP_FULL_SET     ((kernel_cap_t){{ ~0, CAP_LAST_U32_VALID_MASK }})
# define CAP_FS_SET       ((kernel_cap_t){{ CAP_FS_MASK_B0 \
				    | CAP_TO_MASK(CAP_LINUX_IMMUTABLE), \
				    CAP_FS_MASK_B1 } })
# define CAP_NFSD_SET     ((kernel_cap_t){{ CAP_FS_MASK_B0 \
				    | CAP_TO_MASK(CAP_SYS_RESOURCE), \
				    CAP_FS_MASK_B1 } })

#endif /* _KERNEL_CAPABILITY_U32S != 2 */

# define cap_clear(c)         do { (c) = __cap_empty_set; } while (0)

#define cap_raise(c, flag)  ((c).cap[CAP_TO_INDEX(flag)] |= CAP_TO_MASK(flag))
#define cap_lower(c, flag)  ((c).cap[CAP_TO_INDEX(flag)] &= ~CAP_TO_MASK(flag))
#define cap_raised(c, flag) ((c).cap[CAP_TO_INDEX(flag)] & CAP_TO_MASK(flag))

#define CAP_BOP_ALL(c, a, b, OP)                                    \
do {                                                                \
	unsigned __capi;                                            \
	CAP_FOR_EACH_U32(__capi) {                                  \
		c.cap[__capi] = a.cap[__capi] OP b.cap[__capi];     \
	}                                                           \
} while (0)

#define CAP_UOP_ALL(c, a, OP)                                       \
do {                                                                \
	unsigned __capi;                                            \
	CAP_FOR_EACH_U32(__capi) {                                  \
		c.cap[__capi] = OP a.cap[__capi];                   \
	}                                                           \
} while (0)

static inline kernel_cap_t cap_combine(const kernel_cap_t a,
				       const kernel_cap_t b)
{
	kernel_cap_t dest;
	CAP_BOP_ALL(dest, a, b, |);
	return dest;
}

static inline kernel_cap_t cap_intersect(const kernel_cap_t a,
					 const kernel_cap_t b)
{
	kernel_cap_t dest;
	CAP_BOP_ALL(dest, a, b, &);
	return dest;
}

static inline kernel_cap_t cap_drop(const kernel_cap_t a,
				    const kernel_cap_t drop)
{
	kernel_cap_t dest;
	CAP_BOP_ALL(dest, a, drop, &~);
	return dest;
}

static inline kernel_cap_t cap_invert(const kernel_cap_t c)
{
	kernel_cap_t dest;
	CAP_UOP_ALL(dest, c, ~);
	return dest;
}

static inline bool cap_isclear(const kernel_cap_t a)
{
	unsigned __capi;
	CAP_FOR_EACH_U32(__capi) {
		if (a.cap[__capi] != 0)
			return false;
	}
	return true;
}

/*
 * Check if "a" is a subset of "set".
 * return true if ALL of the capabilities in "a" are also in "set"
 *	cap_issubset(0101, 1111) will return true
 * return false if ANY of the capabilities in "a" are not in "set"
 *	cap_issubset(1111, 0101) will return false
 */
static inline bool cap_issubset(const kernel_cap_t a, const kernel_cap_t set)
{
	kernel_cap_t dest;
	dest = cap_drop(a, set);
	return cap_isclear(dest);
}

/* Used to decide between falling back on the old suser() or fsuser(). */

static inline kernel_cap_t cap_drop_fs_set(const kernel_cap_t a)
{
	const kernel_cap_t __cap_fs_set = CAP_FS_SET;
	return cap_drop(a, __cap_fs_set);
}

static inline kernel_cap_t cap_raise_fs_set(const kernel_cap_t a,
					    const kernel_cap_t permitted)
{
	const kernel_cap_t __cap_fs_set = CAP_FS_SET;
	return cap_combine(a,
			   cap_intersect(permitted, __cap_fs_set));
}

static inline kernel_cap_t cap_drop_nfsd_set(const kernel_cap_t a)
{
	const kernel_cap_t __cap_fs_set = CAP_NFSD_SET;
	return cap_drop(a, __cap_fs_set);
}

static inline kernel_cap_t cap_raise_nfsd_set(const kernel_cap_t a,
					      const kernel_cap_t permitted)
{
	const kernel_cap_t __cap_nfsd_set = CAP_NFSD_SET;
	return cap_combine(a,
			   cap_intersect(permitted, __cap_nfsd_set));
}

#ifdef CONFIG_MULTIUSER
extern bool has_capability(struct task_struct *t, int cap);
extern bool has_ns_capability(struct task_struct *t,
			      struct user_namespace *ns, int cap);
extern bool has_capability_noaudit(struct task_struct *t, int cap);
extern bool has_ns_capability_noaudit(struct task_struct *t,
				      struct user_namespace *ns, int cap);
extern bool capable(int cap);
extern bool ns_capable(struct user_namespace *ns, int cap);
#else
static inline bool has_capability(struct task_struct *t, int cap)
{
	return true;
}
static inline bool has_ns_capability(struct task_struct *t,
			      struct user_namespace *ns, int cap)
{
	return true;
}
static inline bool has_capability_noaudit(struct task_struct *t, int cap)
{
	return true;
}
static inline bool has_ns_capability_noaudit(struct task_struct *t,
				      struct user_namespace *ns, int cap)
{
	return true;
}
static inline bool capable(int cap)
{
	return true;
}
static inline bool ns_capable(struct user_namespace *ns, int cap)
{
	return true;
}
#endif /* CONFIG_MULTIUSER */
extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap);
extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);

/* audit system wants to get cap info from files as well */
extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);

#endif /* !_LINUX_CAPABILITY_H */
Commit	Line	Data
	1	/*
	2	* This is <linux/capability.h>
	3	*
	4	* Andrew G. Morgan <morgan@kernel.org>
	5	* Alexander Kjeldaas <astor@guardian.no>
	6	* with help from Aleph1, Roland Buresund and Andrew Main.
	7	*
	8	* See here for the libcap library ("POSIX draft" compliance):
	9	*
	10	* ftp://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.6/
	11	*/
	12	#ifndef _LINUX_CAPABILITY_H
	13	#define _LINUX_CAPABILITY_H
	14
	15	#include <uapi/linux/capability.h>
	16
	17
	18	#define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3
	19	#define _KERNEL_CAPABILITY_U32S _LINUX_CAPABILITY_U32S_3
	20
	21	extern int file_caps_enabled;
	22
	23	typedef struct kernel_cap_struct {
	24	__u32 cap[_KERNEL_CAPABILITY_U32S];
	25	} kernel_cap_t;
	26
	27	/* exact same as vfs_cap_data but in cpu endian and always filled completely */
	28	struct cpu_vfs_cap_data {
	29	__u32 magic_etc;
	30	kernel_cap_t permitted;
	31	kernel_cap_t inheritable;
	32	};
	33
	34	#define _USER_CAP_HEADER_SIZE (sizeof(struct __user_cap_header_struct))
	35	#define _KERNEL_CAP_T_SIZE (sizeof(kernel_cap_t))
	36
	37
	38	struct file;
	39	struct inode;
	40	struct dentry;
	41	struct user_namespace;
	42
	43	extern const kernel_cap_t __cap_empty_set;
	44	extern const kernel_cap_t __cap_init_eff_set;
	45
	46	/*
	47	* Internal kernel functions only
	48	*/
	49
	50	#define CAP_FOR_EACH_U32(__capi) \
	51	for (__capi = 0; __capi < _KERNEL_CAPABILITY_U32S; ++__capi)
	52
	53	/*
	54	* CAP_FS_MASK and CAP_NFSD_MASKS:
	55	*
	56	* The fs mask is all the privileges that fsuid==0 historically meant.
	57	* At one time in the past, that included CAP_MKNOD and CAP_LINUX_IMMUTABLE.
	58	*
	59	* It has never meant setting security.* and trusted.* xattrs.
	60	*
	61	* We could also define fsmask as follows:
	62	* 1. CAP_FS_MASK is the privilege to bypass all fs-related DAC permissions
	63	* 2. The security.* and trusted.* xattrs are fs-related MAC permissions
	64	*/
	65
	66	# define CAP_FS_MASK_B0 (CAP_TO_MASK(CAP_CHOWN) \
	67	\| CAP_TO_MASK(CAP_MKNOD) \
	68	\| CAP_TO_MASK(CAP_DAC_OVERRIDE) \
	69	\| CAP_TO_MASK(CAP_DAC_READ_SEARCH) \
	70	\| CAP_TO_MASK(CAP_FOWNER) \
	71	\| CAP_TO_MASK(CAP_FSETID))
	72
	73	# define CAP_FS_MASK_B1 (CAP_TO_MASK(CAP_MAC_OVERRIDE))
	74
	75	#if _KERNEL_CAPABILITY_U32S != 2
	76	# error Fix up hand-coded capability macro initializers
	77	#else /* HAND-CODED capability initializers */
	78
	79	#define CAP_LAST_U32 ((_KERNEL_CAPABILITY_U32S) - 1)
	80	#define CAP_LAST_U32_VALID_MASK (CAP_TO_MASK(CAP_LAST_CAP + 1) -1)
	81
	82	# define CAP_EMPTY_SET ((kernel_cap_t){{ 0, 0 }})
	83	# define CAP_FULL_SET ((kernel_cap_t){{ ~0, CAP_LAST_U32_VALID_MASK }})
	84	# define CAP_FS_SET ((kernel_cap_t){{ CAP_FS_MASK_B0 \
	85	\| CAP_TO_MASK(CAP_LINUX_IMMUTABLE), \
	86	CAP_FS_MASK_B1 } })
	87	# define CAP_NFSD_SET ((kernel_cap_t){{ CAP_FS_MASK_B0 \
	88	\| CAP_TO_MASK(CAP_SYS_RESOURCE), \
	89	CAP_FS_MASK_B1 } })
	90
	91	#endif /* _KERNEL_CAPABILITY_U32S != 2 */
	92
	93	# define cap_clear(c) do { (c) = __cap_empty_set; } while (0)
	94
	95	#define cap_raise(c, flag) ((c).cap[CAP_TO_INDEX(flag)] \|= CAP_TO_MASK(flag))
	96	#define cap_lower(c, flag) ((c).cap[CAP_TO_INDEX(flag)] &= ~CAP_TO_MASK(flag))
	97	#define cap_raised(c, flag) ((c).cap[CAP_TO_INDEX(flag)] & CAP_TO_MASK(flag))
	98
	99	#define CAP_BOP_ALL(c, a, b, OP) \
	100	do { \
	101	unsigned __capi; \
	102	CAP_FOR_EACH_U32(__capi) { \
	103	c.cap[__capi] = a.cap[__capi] OP b.cap[__capi]; \
	104	} \
	105	} while (0)
	106
	107	#define CAP_UOP_ALL(c, a, OP) \
	108	do { \
	109	unsigned __capi; \
	110	CAP_FOR_EACH_U32(__capi) { \
	111	c.cap[__capi] = OP a.cap[__capi]; \
	112	} \
	113	} while (0)
	114
	115	static inline kernel_cap_t cap_combine(const kernel_cap_t a,
	116	const kernel_cap_t b)
	117	{
	118	kernel_cap_t dest;
	119	CAP_BOP_ALL(dest, a, b, \|);
	120	return dest;
	121	}
	122
	123	static inline kernel_cap_t cap_intersect(const kernel_cap_t a,
	124	const kernel_cap_t b)
	125	{
	126	kernel_cap_t dest;
	127	CAP_BOP_ALL(dest, a, b, &);
	128	return dest;
	129	}
	130
	131	static inline kernel_cap_t cap_drop(const kernel_cap_t a,
	132	const kernel_cap_t drop)
	133	{
	134	kernel_cap_t dest;
	135	CAP_BOP_ALL(dest, a, drop, &~);
	136	return dest;
	137	}
	138
	139	static inline kernel_cap_t cap_invert(const kernel_cap_t c)
	140	{
	141	kernel_cap_t dest;
	142	CAP_UOP_ALL(dest, c, ~);
	143	return dest;
	144	}
	145
	146	static inline bool cap_isclear(const kernel_cap_t a)
	147	{
	148	unsigned __capi;
	149	CAP_FOR_EACH_U32(__capi) {
	150	if (a.cap[__capi] != 0)
	151	return false;
	152	}
	153	return true;
	154	}
	155
	156	/*
	157	* Check if "a" is a subset of "set".
	158	* return true if ALL of the capabilities in "a" are also in "set"
	159	* cap_issubset(0101, 1111) will return true
	160	* return false if ANY of the capabilities in "a" are not in "set"
	161	* cap_issubset(1111, 0101) will return false
	162	*/
	163	static inline bool cap_issubset(const kernel_cap_t a, const kernel_cap_t set)
	164	{
	165	kernel_cap_t dest;
	166	dest = cap_drop(a, set);
	167	return cap_isclear(dest);
	168	}
	169
	170	/* Used to decide between falling back on the old suser() or fsuser(). */
	171
	172	static inline kernel_cap_t cap_drop_fs_set(const kernel_cap_t a)
	173	{
	174	const kernel_cap_t __cap_fs_set = CAP_FS_SET;
	175	return cap_drop(a, __cap_fs_set);
	176	}
	177
	178	static inline kernel_cap_t cap_raise_fs_set(const kernel_cap_t a,
	179	const kernel_cap_t permitted)
	180	{
	181	const kernel_cap_t __cap_fs_set = CAP_FS_SET;
	182	return cap_combine(a,
	183	cap_intersect(permitted, __cap_fs_set));
	184	}
	185
	186	static inline kernel_cap_t cap_drop_nfsd_set(const kernel_cap_t a)
	187	{
	188	const kernel_cap_t __cap_fs_set = CAP_NFSD_SET;
	189	return cap_drop(a, __cap_fs_set);
	190	}
	191
	192	static inline kernel_cap_t cap_raise_nfsd_set(const kernel_cap_t a,
	193	const kernel_cap_t permitted)
	194	{
	195	const kernel_cap_t __cap_nfsd_set = CAP_NFSD_SET;
	196	return cap_combine(a,
	197	cap_intersect(permitted, __cap_nfsd_set));
	198	}
	199
	200	#ifdef CONFIG_MULTIUSER
	201	extern bool has_capability(struct task_struct *t, int cap);
	202	extern bool has_ns_capability(struct task_struct *t,
	203	struct user_namespace *ns, int cap);
	204	extern bool has_capability_noaudit(struct task_struct *t, int cap);
	205	extern bool has_ns_capability_noaudit(struct task_struct *t,
	206	struct user_namespace *ns, int cap);
	207	extern bool capable(int cap);
	208	extern bool ns_capable(struct user_namespace *ns, int cap);
	209	#else
	210	static inline bool has_capability(struct task_struct *t, int cap)
	211	{
	212	return true;
	213	}
	214	static inline bool has_ns_capability(struct task_struct *t,
	215	struct user_namespace *ns, int cap)
	216	{
	217	return true;
	218	}
	219	static inline bool has_capability_noaudit(struct task_struct *t, int cap)
	220	{
	221	return true;
	222	}
	223	static inline bool has_ns_capability_noaudit(struct task_struct *t,
	224	struct user_namespace *ns, int cap)
	225	{
	226	return true;
	227	}
	228	static inline bool capable(int cap)
	229	{
	230	return true;
	231	}
	232	static inline bool ns_capable(struct user_namespace *ns, int cap)
	233	{
	234	return true;
	235	}
	236	#endif /* CONFIG_MULTIUSER */
	237	extern bool capable_wrt_inode_uidgid(const struct inode *inode, int cap);
	238	extern bool file_ns_capable(const struct file file, struct user_namespace ns, int cap);
	239
	240	/* audit system wants to get cap info from files as well */
	241	extern int get_vfs_caps_from_disk(const struct dentry dentry, struct cpu_vfs_cap_data cpu_caps);
	242
	243	#endif /* !_LINUX_CAPABILITY_H */