1 /* vi: set sw=4 ts=4: */
3 * setpriv implementation for busybox based on linux-utils-ng 2.29
5 * Copyright (C) 2017 by <assafgordon@gmail.com>
7 * Licensed under GPLv2 or later, see file LICENSE in this source tree.
10 //config:config SETPRIV
11 //config: bool "setpriv (3.4 kb)"
13 //config: select PLATFORM_LINUX
14 //config: select LONG_OPTS
16 //config: Run a program with different Linux privilege settings.
17 //config: Requires kernel >= 3.5
19 //config:config FEATURE_SETPRIV_DUMP
20 //config: bool "Support dumping current privilege state"
22 //config: depends on SETPRIV
24 //config: Enables the "--dump" switch to print out the current privilege
25 //config: state. This is helpful for diagnosing problems.
27 //config:config FEATURE_SETPRIV_CAPABILITIES
28 //config: bool "Support capabilities"
30 //config: depends on SETPRIV
32 //config: Capabilities can be used to grant processes additional rights
33 //config: without the necessity to always execute as the root user.
34 //config: Enabling this option enables "--dump" to show information on
35 //config: capabilities.
37 //config:config FEATURE_SETPRIV_CAPABILITY_NAMES
38 //config: bool "Support capability names"
40 //config: depends on SETPRIV && FEATURE_SETPRIV_CAPABILITIES
42 //config: Capabilities can be either referenced via a human-readble name,
43 //config: e.g. "net_admin", or using their index, e.g. "cap_12". Enabling
44 //config: this option allows using the human-readable names in addition to
45 //config: the index-based names.
47 //applet:IF_SETPRIV(APPLET(setpriv, BB_DIR_BIN, BB_SUID_DROP))
49 //kbuild:lib-$(CONFIG_SETPRIV) += setpriv.o
51 //usage:#define setpriv_trivial_usage
52 //usage: "[OPTIONS] PROG [ARGS]"
53 //usage:#define setpriv_full_usage "\n\n"
54 //usage: "Run PROG with different privilege settings\n"
55 //usage: IF_FEATURE_SETPRIV_DUMP(
56 //usage: "\n-d,--dump Show current capabilities"
58 //usage: "\n--nnp,--no-new-privs Ignore setuid/setgid bits and file capabilities"
59 //usage: IF_FEATURE_SETPRIV_CAPABILITIES(
60 //usage: "\n--inh-caps CAP,CAP Set inheritable capabilities"
61 //usage: "\n--ambient-caps CAP,CAP Set ambient capabilities"
64 //setpriv from util-linux 2.28:
65 // -d, --dump show current state (and do not exec anything)
66 // --nnp, --no-new-privs disallow granting new privileges
67 // --inh-caps <caps,...> set inheritable capabilities
68 // --bounding-set <caps> set capability bounding set
69 // --ruid <uid> set real uid
70 // --euid <uid> set effective uid
71 // --rgid <gid> set real gid
72 // --egid <gid> set effective gid
73 // --reuid <uid> set real and effective uid
74 // --regid <gid> set real and effective gid
75 // --clear-groups clear supplementary groups
76 // --keep-groups keep supplementary groups
77 // --groups <group,...> set supplementary groups
78 // --securebits <bits> set securebits
79 // --selinux-label <label> set SELinux label
80 // --apparmor-profile <pr> set AppArmor profile
82 #if ENABLE_FEATURE_SETPRIV_CAPABILITIES
83 #include <linux/capability.h>
84 // #include <sys/capability.h>
85 // This header is in libcap, but the functions are in libc.
86 // Comment in the header says this above capset/capget:
87 /* system calls - look to libc for function to system call mapping */
88 extern int capset(cap_user_header_t header, cap_user_data_t data);
89 extern int capget(cap_user_header_t header, const cap_user_data_t data);
90 // so for bbox, let's just repeat the declarations.
91 // This way, libcap needs not be installed in build environment.
93 #include <sys/prctl.h>
96 #ifndef PR_CAPBSET_READ
97 #define PR_CAPBSET_READ 23
100 #ifndef PR_SET_NO_NEW_PRIVS
101 #define PR_SET_NO_NEW_PRIVS 38
104 #ifndef PR_GET_NO_NEW_PRIVS
105 #define PR_GET_NO_NEW_PRIVS 39
108 #ifndef PR_CAP_AMBIENT
109 #define PR_CAP_AMBIENT 47
110 #define PR_CAP_AMBIENT_IS_SET 1
111 #define PR_CAP_AMBIENT_RAISE 2
112 #define PR_CAP_AMBIENT_LOWER 3
116 IF_FEATURE_SETPRIV_DUMP(OPTBIT_DUMP,)
117 IF_FEATURE_SETPRIV_CAPABILITIES(OPTBIT_INH,)
118 IF_FEATURE_SETPRIV_CAPABILITIES(OPTBIT_AMB,)
121 IF_FEATURE_SETPRIV_DUMP(OPT_DUMP = (1 << OPTBIT_DUMP),)
122 IF_FEATURE_SETPRIV_CAPABILITIES(OPT_INH = (1 << OPTBIT_INH),)
123 IF_FEATURE_SETPRIV_CAPABILITIES(OPT_AMB = (1 << OPTBIT_AMB),)
124 OPT_NNP = (1 << OPTBIT_NNP),
127 #if ENABLE_FEATURE_SETPRIV_CAPABILITIES
129 struct __user_cap_header_struct header;
130 cap_user_data_t data;
134 # if ENABLE_FEATURE_SETPRIV_CAPABILITY_NAMES
135 static const char *const capabilities[] = {
175 # endif /* FEATURE_SETPRIV_CAPABILITY_NAMES */
177 static void getcaps(struct caps *caps)
179 static const uint8_t versions[] = {
180 _LINUX_CAPABILITY_U32S_3, /* = 2 (fits into byte) */
181 _LINUX_CAPABILITY_U32S_2, /* = 2 */
182 _LINUX_CAPABILITY_U32S_1, /* = 1 */
186 caps->header.pid = 0;
187 for (i = 0; i < ARRAY_SIZE(versions); i++) {
188 caps->header.version = versions[i];
189 if (capget(&caps->header, NULL) == 0)
192 bb_simple_perror_msg_and_die("capget");
195 switch (caps->header.version) {
196 case _LINUX_CAPABILITY_VERSION_1:
197 caps->u32s = _LINUX_CAPABILITY_U32S_1;
199 case _LINUX_CAPABILITY_VERSION_2:
200 caps->u32s = _LINUX_CAPABILITY_U32S_2;
202 case _LINUX_CAPABILITY_VERSION_3:
203 caps->u32s = _LINUX_CAPABILITY_U32S_3;
206 bb_error_msg_and_die("unsupported capability version");
209 caps->data = xmalloc(sizeof(caps->data[0]) * caps->u32s);
210 if (capget(&caps->header, caps->data) < 0)
211 bb_simple_perror_msg_and_die("capget");
214 static void parse_cap(unsigned long *index, const char *cap)
224 bb_error_msg_and_die("invalid capability '%s'", cap);
229 if ((sscanf(cap, "cap_%lu", &i)) == 1) {
231 bb_error_msg_and_die("unsupported capability '%s'", cap);
236 # if ENABLE_FEATURE_SETPRIV_CAPABILITY_NAMES
237 for (i = 0; i < ARRAY_SIZE(capabilities); i++) {
238 if (strcmp(capabilities[i], cap) != 0)
242 bb_error_msg_and_die("unsupported capability '%s'", cap);
248 bb_error_msg_and_die("unknown capability '%s'", cap);
251 static void set_inh_caps(char *capstring)
257 capstring = strtok(capstring, ",");
261 parse_cap(&cap, capstring);
262 if (CAP_TO_INDEX(cap) >= caps.u32s)
263 bb_error_msg_and_die("invalid capability cap");
265 if (capstring[0] == '+')
266 caps.data[CAP_TO_INDEX(cap)].inheritable |= CAP_TO_MASK(cap);
268 caps.data[CAP_TO_INDEX(cap)].inheritable &= ~CAP_TO_MASK(cap);
269 capstring = strtok(NULL, ",");
272 if ((capset(&caps.header, caps.data)) < 0)
273 bb_perror_msg_and_die("capset");
275 if (ENABLE_FEATURE_CLEAN_UP)
279 static void set_ambient_caps(char *string)
283 cap = strtok(string, ",");
287 parse_cap(&index, cap);
289 if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, index, 0, 0) < 0)
290 bb_perror_msg("cap_ambient_raise");
292 if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_LOWER, index, 0, 0) < 0)
293 bb_perror_msg("cap_ambient_lower");
295 cap = strtok(NULL, ",");
298 #endif /* FEATURE_SETPRIV_CAPABILITIES */
300 #if ENABLE_FEATURE_SETPRIV_DUMP
301 # if ENABLE_FEATURE_SETPRIV_CAPABILITY_NAMES
302 static void printf_cap(const char *pfx, unsigned cap_no)
304 if (cap_no < ARRAY_SIZE(capabilities)) {
305 printf("%s%s", pfx, capabilities[cap_no]);
308 printf("%scap_%u", pfx, cap_no);
311 # define printf_cap(pfx, cap_no) printf("%scap_%u", (pfx), (cap_no))
314 static int dump(void)
316 IF_FEATURE_SETPRIV_CAPABILITIES(struct caps caps;)
318 uid_t ruid, euid, suid;
319 gid_t rgid, egid, sgid;
323 getresuid(&ruid, &euid, &suid); /* never fails in Linux */
324 getresgid(&rgid, &egid, &sgid); /* never fails in Linux */
326 gids = bb_getgroups(&ngids, NULL); /* never fails in Linux */
328 nnp = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
330 bb_perror_msg_and_die("prctl: %s", "GET_NO_NEW_PRIVS");
332 printf("uid: %u\n", (unsigned)ruid);
333 printf("euid: %u\n", (unsigned)euid);
334 printf("gid: %u\n", (unsigned)rgid);
335 printf("egid: %u\n", (unsigned)egid);
337 printf("Supplementary groups: ");
342 for (i = 0; i < ngids; i++) {
343 printf(fmt, (unsigned)gids[i]);
347 printf("\nno_new_privs: %d\n", nnp);
349 # if ENABLE_FEATURE_SETPRIV_CAPABILITIES
351 printf("Inheritable capabilities: ");
353 for (i = 0; cap_valid(i); i++) {
354 unsigned idx = CAP_TO_INDEX(i);
355 if (idx >= caps.u32s) {
356 printf("\nindex: %u u32s: %u capability: %u\n", idx, caps.u32s, i);
357 bb_error_msg_and_die("unsupported capability");
359 if (caps.data[idx].inheritable & CAP_TO_MASK(i)) {
367 printf("\nAmbient capabilities: ");
369 for (i = 0; cap_valid(i); i++) {
370 int ret = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, (unsigned long) i, 0UL, 0UL);
372 bb_perror_msg_and_die("prctl: %s", "CAP_AMBIENT_IS_SET");
379 printf("[unsupported]");
383 printf("\nCapability bounding set: ");
385 for (i = 0; cap_valid(i); i++) {
386 int ret = prctl(PR_CAPBSET_READ, (unsigned long) i, 0UL, 0UL, 0UL);
388 bb_perror_msg_and_die("prctl: %s", "CAPBSET_READ");
399 if (ENABLE_FEATURE_CLEAN_UP) {
400 IF_FEATURE_SETPRIV_CAPABILITIES(free(caps.data);)
405 #endif /* FEATURE_SETPRIV_DUMP */
407 int setpriv_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
408 int setpriv_main(int argc UNUSED_PARAM, char **argv)
410 static const char setpriv_longopts[] ALIGN1 =
411 IF_FEATURE_SETPRIV_DUMP(
412 "dump\0" No_argument "d"
414 "nnp\0" No_argument "\xff"
415 "no-new-privs\0" No_argument "\xff"
416 IF_FEATURE_SETPRIV_CAPABILITIES(
417 "inh-caps\0" Required_argument "\xfe"
418 "ambient-caps\0" Required_argument "\xfd"
422 IF_FEATURE_SETPRIV_CAPABILITIES(char *inh_caps, *ambient_caps;)
424 applet_long_options = setpriv_longopts;
425 opts = getopt32(argv, "+"IF_FEATURE_SETPRIV_DUMP("d")
426 IF_FEATURE_SETPRIV_CAPABILITIES("\xfe:\xfd:", &inh_caps, &ambient_caps));
429 #if ENABLE_FEATURE_SETPRIV_DUMP
430 if (opts & OPT_DUMP) {
431 if (argv[0] || (opts - OPT_DUMP) != 0)
436 if (opts & OPT_NNP) {
437 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
438 bb_perror_msg_and_die("prctl: %s", "SET_NO_NEW_PRIVS");
441 #if ENABLE_FEATURE_SETPRIV_CAPABILITIES
443 set_inh_caps(inh_caps);
445 set_ambient_caps(ambient_caps);
450 BB_EXECVP_or_die(argv);