1/*- 2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD 3 * 4 * Copyright (c) 2013 FreeBSD Foundation 5 * All rights reserved. 6 * 7 * This software was developed by Pawel Jakub Dawidek under sponsorship from 8 * the FreeBSD Foundation. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32#include <sys/cdefs.h> 33__FBSDID("$FreeBSD$"); 34 35/* 36 * Note that this file is compiled into the kernel and into libc. 37 */ 38 39#include <sys/types.h> 40#include <sys/capsicum.h> 41 42#ifdef _KERNEL 43#include <sys/systm.h> 44#include <sys/kernel.h> 45#include <machine/stdarg.h> 46#else /* !_KERNEL */ 47#include <assert.h> 48#include <stdarg.h> 49#include <stdbool.h> 50#include <stdint.h> 51#include <string.h> 52#endif 53 54#ifdef _KERNEL 55#define assert(exp) KASSERT((exp), ("%s:%u", __func__, __LINE__)) 56__read_mostly cap_rights_t cap_accept_rights; 57__read_mostly cap_rights_t cap_bind_rights; 58__read_mostly cap_rights_t cap_chflags_rights; 59__read_mostly cap_rights_t cap_connect_rights; 60__read_mostly cap_rights_t cap_event_rights; 61__read_mostly cap_rights_t cap_fchdir_rights; 62__read_mostly cap_rights_t cap_fchflags_rights; 63__read_mostly cap_rights_t cap_fchmod_rights; 64__read_mostly cap_rights_t cap_fchown_rights; 65__read_mostly cap_rights_t cap_fcntl_rights; 66__read_mostly cap_rights_t cap_fexecve_rights; 67__read_mostly cap_rights_t cap_flock_rights; 68__read_mostly cap_rights_t cap_fpathconf_rights; 69__read_mostly cap_rights_t cap_fstat_rights; 70__read_mostly cap_rights_t cap_fstatfs_rights; 71__read_mostly cap_rights_t cap_fsync_rights; 72__read_mostly cap_rights_t cap_ftruncate_rights; 73__read_mostly cap_rights_t cap_futimes_rights; 74__read_mostly cap_rights_t cap_getpeername_rights; 75__read_mostly cap_rights_t cap_getsockopt_rights; 76__read_mostly cap_rights_t cap_getsockname_rights; 77__read_mostly cap_rights_t cap_ioctl_rights; 78__read_mostly cap_rights_t cap_listen_rights; 79__read_mostly cap_rights_t cap_linkat_source_rights; 80__read_mostly cap_rights_t cap_linkat_target_rights; 81__read_mostly cap_rights_t cap_mmap_rights; 82__read_mostly cap_rights_t cap_mkdirat_rights; 83__read_mostly cap_rights_t cap_mkfifoat_rights; 84__read_mostly cap_rights_t cap_mknodat_rights; 85__read_mostly cap_rights_t cap_pdgetpid_rights; 86__read_mostly cap_rights_t cap_pdkill_rights; 87__read_mostly cap_rights_t cap_pread_rights; 88__read_mostly cap_rights_t cap_pwrite_rights; 89__read_mostly cap_rights_t cap_read_rights; 90__read_mostly cap_rights_t cap_recv_rights; 91__read_mostly cap_rights_t cap_renameat_source_rights; 92__read_mostly cap_rights_t cap_renameat_target_rights; 93__read_mostly cap_rights_t cap_seek_rights; 94__read_mostly cap_rights_t cap_send_rights; 95__read_mostly cap_rights_t cap_send_connect_rights; 96__read_mostly cap_rights_t cap_setsockopt_rights; 97__read_mostly cap_rights_t cap_shutdown_rights; 98__read_mostly cap_rights_t cap_symlinkat_rights; 99__read_mostly cap_rights_t cap_unlinkat_rights; 100__read_mostly cap_rights_t cap_write_rights; 101__read_mostly cap_rights_t cap_no_rights; 102 103static void 104cap_rights_sysinit(void *arg) 105{ 106 cap_rights_init(&cap_accept_rights, CAP_ACCEPT); 107 cap_rights_init(&cap_bind_rights, CAP_BIND); 108 cap_rights_init(&cap_connect_rights, CAP_CONNECT); 109 cap_rights_init(&cap_event_rights, CAP_EVENT); 110 cap_rights_init(&cap_fchdir_rights, CAP_FCHDIR); 111 cap_rights_init(&cap_fchflags_rights, CAP_FCHFLAGS); 112 cap_rights_init(&cap_fchmod_rights, CAP_FCHMOD); 113 cap_rights_init(&cap_fchown_rights, CAP_FCHOWN); 114 cap_rights_init(&cap_fcntl_rights, CAP_FCNTL); 115 cap_rights_init(&cap_fexecve_rights, CAP_FEXECVE); 116 cap_rights_init(&cap_flock_rights, CAP_FLOCK); 117 cap_rights_init(&cap_fpathconf_rights, CAP_FPATHCONF); 118 cap_rights_init(&cap_fstat_rights, CAP_FSTAT); 119 cap_rights_init(&cap_fstatfs_rights, CAP_FSTATFS); 120 cap_rights_init(&cap_fsync_rights, CAP_FSYNC); 121 cap_rights_init(&cap_ftruncate_rights, CAP_FTRUNCATE); 122 cap_rights_init(&cap_futimes_rights, CAP_FUTIMES); 123 cap_rights_init(&cap_getpeername_rights, CAP_GETPEERNAME); 124 cap_rights_init(&cap_getsockname_rights, CAP_GETSOCKNAME); 125 cap_rights_init(&cap_getsockopt_rights, CAP_GETSOCKOPT); 126 cap_rights_init(&cap_ioctl_rights, CAP_IOCTL); 127 cap_rights_init(&cap_linkat_source_rights, CAP_LINKAT_SOURCE); 128 cap_rights_init(&cap_linkat_target_rights, CAP_LINKAT_TARGET); 129 cap_rights_init(&cap_listen_rights, CAP_LISTEN); 130 cap_rights_init(&cap_mkdirat_rights, CAP_MKDIRAT); 131 cap_rights_init(&cap_mkfifoat_rights, CAP_MKFIFOAT); 132 cap_rights_init(&cap_mknodat_rights, CAP_MKNODAT); 133 cap_rights_init(&cap_mmap_rights, CAP_MMAP); 134 cap_rights_init(&cap_pdgetpid_rights, CAP_PDGETPID); 135 cap_rights_init(&cap_pdkill_rights, CAP_PDKILL); 136 cap_rights_init(&cap_pread_rights, CAP_PREAD); 137 cap_rights_init(&cap_pwrite_rights, CAP_PWRITE); 138 cap_rights_init(&cap_read_rights, CAP_READ); 139 cap_rights_init(&cap_recv_rights, CAP_RECV); 140 cap_rights_init(&cap_renameat_source_rights, CAP_RENAMEAT_SOURCE); 141 cap_rights_init(&cap_renameat_target_rights, CAP_RENAMEAT_TARGET); 142 cap_rights_init(&cap_seek_rights, CAP_SEEK); 143 cap_rights_init(&cap_send_rights, CAP_SEND); 144 cap_rights_init(&cap_send_connect_rights, CAP_SEND, CAP_CONNECT); 145 cap_rights_init(&cap_setsockopt_rights, CAP_SETSOCKOPT); 146 cap_rights_init(&cap_shutdown_rights, CAP_SHUTDOWN); 147 cap_rights_init(&cap_symlinkat_rights, CAP_SYMLINKAT); 148 cap_rights_init(&cap_unlinkat_rights, CAP_UNLINKAT); 149 cap_rights_init(&cap_write_rights, CAP_WRITE); 150 cap_rights_init(&cap_no_rights); 151} 152SYSINIT(cap_rights_sysinit, SI_SUB_COPYRIGHT, SI_ORDER_ANY, cap_rights_sysinit, 153 NULL); 154 155#endif 156 157#define CAPARSIZE_MIN (CAP_RIGHTS_VERSION_00 + 2) 158#define CAPARSIZE_MAX (CAP_RIGHTS_VERSION + 2) 159 160static __inline int 161right_to_index(uint64_t right) 162{ 163 static const int bit2idx[] = { 164 -1, 0, 1, -1, 2, -1, -1, -1, 3, -1, -1, -1, -1, -1, -1, -1, 165 4, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1 166 }; 167 int idx; 168 169 idx = CAPIDXBIT(right); 170 assert(idx >= 0 && idx < sizeof(bit2idx) / sizeof(bit2idx[0])); 171 return (bit2idx[idx]); 172} 173 174static void 175cap_rights_vset(cap_rights_t *rights, va_list ap) 176{ 177 uint64_t right; 178 int i, n __unused; 179 180 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 181 182 n = CAPARSIZE(rights); 183 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 184 185 for (;;) { 186 right = (uint64_t)va_arg(ap, unsigned long long); 187 if (right == 0) 188 break; 189 assert(CAPRVER(right) == 0); 190 i = right_to_index(right); 191 assert(i >= 0); 192 assert(i < n); 193 assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right)); 194 rights->cr_rights[i] |= right; 195 assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right)); 196 } 197} 198 199static void 200cap_rights_vclear(cap_rights_t *rights, va_list ap) 201{ 202 uint64_t right; 203 int i, n __unused; 204 205 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 206 207 n = CAPARSIZE(rights); 208 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 209 210 for (;;) { 211 right = (uint64_t)va_arg(ap, unsigned long long); 212 if (right == 0) 213 break; 214 assert(CAPRVER(right) == 0); 215 i = right_to_index(right); 216 assert(i >= 0); 217 assert(i < n); 218 assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right)); 219 rights->cr_rights[i] &= ~(right & 0x01FFFFFFFFFFFFFFULL); 220 assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right)); 221 } 222} 223 224static bool 225cap_rights_is_vset(const cap_rights_t *rights, va_list ap) 226{ 227 uint64_t right; 228 int i, n __unused; 229 230 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 231 232 n = CAPARSIZE(rights); 233 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 234 235 for (;;) { 236 right = (uint64_t)va_arg(ap, unsigned long long); 237 if (right == 0) 238 break; 239 assert(CAPRVER(right) == 0); 240 i = right_to_index(right); 241 assert(i >= 0); 242 assert(i < n); 243 assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right)); 244 if ((rights->cr_rights[i] & right) != right) 245 return (false); 246 } 247 248 return (true); 249} 250 251cap_rights_t * 252__cap_rights_init(int version, cap_rights_t *rights, ...) 253{ 254 unsigned int n __unused; 255 va_list ap; 256 257 assert(version == CAP_RIGHTS_VERSION_00); 258 259 n = version + 2; 260 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 261 CAP_NONE(rights); 262 va_start(ap, rights); 263 cap_rights_vset(rights, ap); 264 va_end(ap); 265 266 return (rights); 267} 268 269cap_rights_t * 270__cap_rights_set(cap_rights_t *rights, ...) 271{ 272 va_list ap; 273 274 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 275 276 va_start(ap, rights); 277 cap_rights_vset(rights, ap); 278 va_end(ap); 279 280 return (rights); 281} 282 283cap_rights_t * 284__cap_rights_clear(cap_rights_t *rights, ...) 285{ 286 va_list ap; 287 288 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 289 290 va_start(ap, rights); 291 cap_rights_vclear(rights, ap); 292 va_end(ap); 293 294 return (rights); 295} 296 297bool 298__cap_rights_is_set(const cap_rights_t *rights, ...) 299{ 300 va_list ap; 301 bool ret; 302 303 assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00); 304 305 va_start(ap, rights); 306 ret = cap_rights_is_vset(rights, ap); 307 va_end(ap); 308 309 return (ret); 310} 311 312bool 313cap_rights_is_valid(const cap_rights_t *rights) 314{ 315 cap_rights_t allrights; 316 int i, j; 317 318 if (CAPVER(rights) != CAP_RIGHTS_VERSION_00) 319 return (false); 320 if (CAPARSIZE(rights) < CAPARSIZE_MIN || 321 CAPARSIZE(rights) > CAPARSIZE_MAX) { 322 return (false); 323 } 324 CAP_ALL(&allrights); 325 if (!cap_rights_contains(&allrights, rights)) 326 return (false); 327 for (i = 0; i < CAPARSIZE(rights); i++) { 328 j = right_to_index(rights->cr_rights[i]); 329 if (i != j) 330 return (false); 331 if (i > 0) { 332 if (CAPRVER(rights->cr_rights[i]) != 0) 333 return (false); 334 } 335 } 336 337 return (true); 338} 339 340cap_rights_t * 341cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src) 342{ 343 unsigned int i, n; 344 345 assert(CAPVER(dst) == CAP_RIGHTS_VERSION_00); 346 assert(CAPVER(src) == CAP_RIGHTS_VERSION_00); 347 assert(CAPVER(dst) == CAPVER(src)); 348 assert(cap_rights_is_valid(src)); 349 assert(cap_rights_is_valid(dst)); 350 351 n = CAPARSIZE(dst); 352 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 353 354 for (i = 0; i < n; i++) 355 dst->cr_rights[i] |= src->cr_rights[i]; 356 357 assert(cap_rights_is_valid(src)); 358 assert(cap_rights_is_valid(dst)); 359 360 return (dst); 361} 362 363cap_rights_t * 364cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src) 365{ 366 unsigned int i, n; 367 368 assert(CAPVER(dst) == CAP_RIGHTS_VERSION_00); 369 assert(CAPVER(src) == CAP_RIGHTS_VERSION_00); 370 assert(CAPVER(dst) == CAPVER(src)); 371 assert(cap_rights_is_valid(src)); 372 assert(cap_rights_is_valid(dst)); 373 374 n = CAPARSIZE(dst); 375 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 376 377 for (i = 0; i < n; i++) { 378 dst->cr_rights[i] &= 379 ~(src->cr_rights[i] & 0x01FFFFFFFFFFFFFFULL); 380 } 381 382 assert(cap_rights_is_valid(src)); 383 assert(cap_rights_is_valid(dst)); 384 385 return (dst); 386} 387 388bool 389cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little) 390{ 391 unsigned int i, n; 392 393 assert(CAPVER(big) == CAP_RIGHTS_VERSION_00); 394 assert(CAPVER(little) == CAP_RIGHTS_VERSION_00); 395 assert(CAPVER(big) == CAPVER(little)); 396 397 n = CAPARSIZE(big); 398 assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX); 399 400 for (i = 0; i < n; i++) { 401 if ((big->cr_rights[i] & little->cr_rights[i]) != 402 little->cr_rights[i]) { 403 return (false); 404 } 405 } 406 407 return (true); 408} 409