/* vi: set sw=4 ts=4: */ /* * setpriv implementation for busybox based on linux-utils-ng 2.29 * * Copyright (C) 2017 by <assafgordon@gmail.com> * * Licensed under GPLv2 or later, see file LICENSE in this source tree. */ //config:config SETPRIV //config: bool "setpriv (3.4 kb)" //config: default y //config: select PLATFORM_LINUX //config: select LONG_OPTS //config: help //config: Run a program with different Linux privilege settings. //config: Requires kernel >= 3.5 //config: //config:config FEATURE_SETPRIV_DUMP //config: bool "Support dumping current privilege state" //config: default y //config: depends on SETPRIV //config: help //config: Enables the "--dump" switch to print out the current privilege //config: state. This is helpful for diagnosing problems. //config: //config:config FEATURE_SETPRIV_CAPABILITIES //config: bool "Support capabilities" //config: default y //config: depends on SETPRIV //config: help //config: Capabilities can be used to grant processes additional rights //config: without the necessity to always execute as the root user. //config: Enabling this option enables "--dump" to show information on //config: capabilities. //config: //config:config FEATURE_SETPRIV_CAPABILITY_NAMES //config: bool "Support capability names" //config: default y //config: depends on SETPRIV && FEATURE_SETPRIV_CAPABILITIES //config: help //config: Capabilities can be either referenced via a human-readble name, //config: e.g. "net_admin", or using their index, e.g. "cap_12". Enabling //config: this option allows using the human-readable names in addition to //config: the index-based names. //applet:IF_SETPRIV(APPLET(setpriv, BB_DIR_BIN, BB_SUID_DROP)) //kbuild:lib-$(CONFIG_SETPRIV) += setpriv.o //usage:#define setpriv_trivial_usage //usage: "[OPTIONS] PROG [ARGS]" //usage:#define setpriv_full_usage "\n\n" //usage: "Run PROG with different privilege settings\n" //usage: IF_FEATURE_SETPRIV_DUMP( //usage: "\n-d,--dump Show current capabilities" //usage: ) //usage: "\n--nnp,--no-new-privs Ignore setuid/setgid bits and file capabilities" //usage: IF_FEATURE_SETPRIV_CAPABILITIES( //usage: "\n--inh-caps CAP,CAP Set inheritable capabilities" //usage: "\n--ambient-caps CAP,CAP Set ambient capabilities" //usage: ) //setpriv from util-linux 2.28: // -d, --dump show current state (and do not exec anything) // --nnp, --no-new-privs disallow granting new privileges // --inh-caps <caps,...> set inheritable capabilities // --bounding-set <caps> set capability bounding set // --ruid <uid> set real uid // --euid <uid> set effective uid // --rgid <gid> set real gid // --egid <gid> set effective gid // --reuid <uid> set real and effective uid // --regid <gid> set real and effective gid // --clear-groups clear supplementary groups // --keep-groups keep supplementary groups // --groups <group,...> set supplementary groups // --securebits <bits> set securebits // --selinux-label <label> set SELinux label // --apparmor-profile <pr> set AppArmor profile #if ENABLE_FEATURE_SETPRIV_CAPABILITIES #include <linux/capability.h> // #include <sys/capability.h> // This header is in libcap, but the functions are in libc. // Comment in the header says this above capset/capget: /* system calls - look to libc for function to system call mapping */ extern int capset(cap_user_header_t header, cap_user_data_t data); extern int capget(cap_user_header_t header, const cap_user_data_t data); // so for bbox, let's just repeat the declarations. // This way, libcap needs not be installed in build environment. #endif #include <sys/prctl.h> #include "libbb.h" #ifndef PR_CAPBSET_READ #define PR_CAPBSET_READ 23 #endif #ifndef PR_SET_NO_NEW_PRIVS #define PR_SET_NO_NEW_PRIVS 38 #endif #ifndef PR_GET_NO_NEW_PRIVS #define PR_GET_NO_NEW_PRIVS 39 #endif #ifndef PR_CAP_AMBIENT #define PR_CAP_AMBIENT 47 #define PR_CAP_AMBIENT_IS_SET 1 #define PR_CAP_AMBIENT_RAISE 2 #define PR_CAP_AMBIENT_LOWER 3 #endif enum { IF_FEATURE_SETPRIV_DUMP(OPTBIT_DUMP,) IF_FEATURE_SETPRIV_CAPABILITIES(OPTBIT_INH,) IF_FEATURE_SETPRIV_CAPABILITIES(OPTBIT_AMB,) OPTBIT_NNP, IF_FEATURE_SETPRIV_DUMP(OPT_DUMP = (1 << OPTBIT_DUMP),) IF_FEATURE_SETPRIV_CAPABILITIES(OPT_INH = (1 << OPTBIT_INH),) IF_FEATURE_SETPRIV_CAPABILITIES(OPT_AMB = (1 << OPTBIT_AMB),) OPT_NNP = (1 << OPTBIT_NNP), }; #if ENABLE_FEATURE_SETPRIV_CAPABILITIES DEFINE_STRUCT_CAPS; static unsigned parse_cap(const char *cap) { switch (cap[0]) { case '-': break; case '+': break; default: bb_error_msg_and_die("invalid capability '%s'", cap); break; } cap++; return cap_name_to_number(cap); } static void set_inh_caps(char *capstring) { struct caps caps; getcaps(&caps); capstring = strtok(capstring, ","); while (capstring) { unsigned cap; cap = parse_cap(capstring); if (CAP_TO_INDEX(cap) >= caps.u32s) bb_error_msg_and_die("invalid capability '%s'", capstring); if (capstring[0] == '+') caps.data[CAP_TO_INDEX(cap)].inheritable |= CAP_TO_MASK(cap); else caps.data[CAP_TO_INDEX(cap)].inheritable &= ~CAP_TO_MASK(cap); capstring = strtok(NULL, ","); } if (capset(&caps.header, caps.data) != 0) bb_perror_msg_and_die("capset"); } static void set_ambient_caps(char *string) { char *cap; cap = strtok(string, ","); while (cap) { unsigned idx; idx = parse_cap(cap); if (cap[0] == '+') { if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, idx, 0, 0) < 0) bb_perror_msg("cap_ambient_raise"); } else { if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_LOWER, idx, 0, 0) < 0) bb_perror_msg("cap_ambient_lower"); } cap = strtok(NULL, ","); } } #endif /* FEATURE_SETPRIV_CAPABILITIES */ #if ENABLE_FEATURE_SETPRIV_DUMP # if !ENABLE_FEATURE_SETPRIV_CAPABILITY_NAMES # define printf_cap(pfx, cap_no) printf("%scap_%u", (pfx), (cap_no)) # endif static int dump(void) { IF_FEATURE_SETPRIV_CAPABILITIES(struct caps caps;) const char *fmt; uid_t ruid, euid, suid; gid_t rgid, egid, sgid; gid_t *gids; int i, ngids, nnp; getresuid(&ruid, &euid, &suid); /* never fails in Linux */ getresgid(&rgid, &egid, &sgid); /* never fails in Linux */ ngids = 0; gids = bb_getgroups(&ngids, NULL); /* never fails in Linux */ nnp = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0); if (nnp < 0) bb_perror_msg_and_die("prctl: %s", "GET_NO_NEW_PRIVS"); printf("uid: %u\n", (unsigned)ruid); printf("euid: %u\n", (unsigned)euid); printf("gid: %u\n", (unsigned)rgid); printf("egid: %u\n", (unsigned)egid); printf("Supplementary groups: "); if (ngids == 0) { printf("[none]"); } else { fmt = ",%u" + 1; for (i = 0; i < ngids; i++) { printf(fmt, (unsigned)gids[i]); fmt = ",%u"; } } printf("\nno_new_privs: %d\n", nnp); # if ENABLE_FEATURE_SETPRIV_CAPABILITIES getcaps(&caps); printf("Inheritable capabilities: "); fmt = ""; for (i = 0; cap_valid(i); i++) { unsigned idx = CAP_TO_INDEX(i); if (idx >= caps.u32s) { printf("\nindex: %u u32s: %u capability: %u\n", idx, caps.u32s, i); bb_error_msg_and_die("unsupported capability"); } if (caps.data[idx].inheritable & CAP_TO_MASK(i)) { printf_cap(fmt, i); fmt = ","; } } if (!fmt[0]) printf("[none]"); printf("\nAmbient capabilities: "); fmt = ""; for (i = 0; cap_valid(i); i++) { int ret = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, (unsigned long) i, 0UL, 0UL); if (ret < 0) bb_perror_msg_and_die("prctl: %s", "CAP_AMBIENT_IS_SET"); if (ret) { printf_cap(fmt, i); fmt = ","; } } if (i == 0) printf("[unsupported]"); else if (!fmt[0]) printf("[none]"); printf("\nCapability bounding set: "); fmt = ""; for (i = 0; cap_valid(i); i++) { int ret = prctl(PR_CAPBSET_READ, (unsigned long) i, 0UL, 0UL, 0UL); if (ret < 0) bb_perror_msg_and_die("prctl: %s", "CAPBSET_READ"); if (ret) { printf_cap(fmt, i); fmt = ","; } } if (!fmt[0]) printf("[none]"); bb_putchar('\n'); # endif if (ENABLE_FEATURE_CLEAN_UP) free(gids); return EXIT_SUCCESS; } #endif /* FEATURE_SETPRIV_DUMP */ int setpriv_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE; int setpriv_main(int argc UNUSED_PARAM, char **argv) { static const char setpriv_longopts[] ALIGN1 = IF_FEATURE_SETPRIV_DUMP( "dump\0" No_argument "d" ) "nnp\0" No_argument "\xff" "no-new-privs\0" No_argument "\xff" IF_FEATURE_SETPRIV_CAPABILITIES( "inh-caps\0" Required_argument "\xfe" "ambient-caps\0" Required_argument "\xfd" ) ; int opts; IF_FEATURE_SETPRIV_CAPABILITIES(char *inh_caps, *ambient_caps;) opts = getopt32long(argv, "+" IF_FEATURE_SETPRIV_DUMP("d") IF_FEATURE_SETPRIV_CAPABILITIES("\xfe:\xfd:"), setpriv_longopts IF_FEATURE_SETPRIV_CAPABILITIES(, &inh_caps, &ambient_caps) ); argv += optind; #if ENABLE_FEATURE_SETPRIV_DUMP if (opts & OPT_DUMP) { if (argv[0] || (opts - OPT_DUMP) != 0) bb_show_usage(); return dump(); } #endif if (opts & OPT_NNP) { if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) bb_perror_msg_and_die("prctl: %s", "SET_NO_NEW_PRIVS"); } #if ENABLE_FEATURE_SETPRIV_CAPABILITIES if (opts & OPT_INH) set_inh_caps(inh_caps); if (opts & OPT_AMB) set_ambient_caps(ambient_caps); #endif if (!argv[0]) bb_show_usage(); BB_EXECVP_or_die(argv); }