1 /* vi: set sw=4 ts=4: */
2 /*
3 * setpriv implementation for busybox based on linux-utils-ng 2.29
4 *
5 * Copyright (C) 2017 by <assafgordon@gmail.com>
6 *
7 * Licensed under GPLv2 or later, see file LICENSE in this source tree.
8 */
9 //config:config SETPRIV
10 //config: bool "setpriv (6.6 kb)"
11 //config: default y
12 //config: select LONG_OPTS
13 //config: help
14 //config: Run a program with different Linux privilege settings.
15 //config: Requires kernel >= 3.5
16 //config:
17 //config:config FEATURE_SETPRIV_DUMP
18 //config: bool "Support dumping current privilege state"
19 //config: default y
20 //config: depends on SETPRIV
21 //config: help
22 //config: Enables the "--dump" switch to print out the current privilege
23 //config: state. This is helpful for diagnosing problems.
24 //config:
25 //config:config FEATURE_SETPRIV_CAPABILITIES
26 //config: bool "Support capabilities"
27 //config: default y
28 //config: depends on SETPRIV
29 //config: help
30 //config: Capabilities can be used to grant processes additional rights
31 //config: without the necessity to always execute as the root user.
32 //config: Enabling this option enables "--dump" to show information on
33 //config: capabilities.
34 //config:
35 //config:config FEATURE_SETPRIV_CAPABILITY_NAMES
36 //config: bool "Support capability names"
37 //config: default y
38 //config: depends on SETPRIV && FEATURE_SETPRIV_CAPABILITIES
39 //config: help
40 //config: Capabilities can be either referenced via a human-readble name,
41 //config: e.g. "net_admin", or using their index, e.g. "cap_12". Enabling
42 //config: this option allows using the human-readable names in addition to
43 //config: the index-based names.
44
45 //applet:IF_SETPRIV(APPLET(setpriv, BB_DIR_BIN, BB_SUID_DROP))
46
47 //kbuild:lib-$(CONFIG_SETPRIV) += setpriv.o
48
49 //usage:#define setpriv_trivial_usage
50 //usage: "[OPTIONS] PROG ARGS"
51 //usage:#define setpriv_full_usage "\n\n"
52 //usage: "Run PROG with different privilege settings\n"
53 //usage: IF_FEATURE_SETPRIV_DUMP(
54 //usage: "\n-d,--dump Show current capabilities"
55 //usage: )
56 //usage: "\n--nnp,--no-new-privs Ignore setuid/setgid bits and file capabilities"
57 //usage: IF_FEATURE_SETPRIV_CAPABILITIES(
58 //usage: "\n--inh-caps CAP,CAP Set inheritable capabilities"
59 //usage: "\n--ambient-caps CAP,CAP Set ambient capabilities"
60 //usage: )
61
62 //setpriv from util-linux 2.28:
63 // -d, --dump show current state (and do not exec anything)
64 // --nnp, --no-new-privs disallow granting new privileges
65 // --inh-caps <caps,...> set inheritable capabilities
66 // --bounding-set <caps> set capability bounding set
67 // --ruid <uid> set real uid
68 // --euid <uid> set effective uid
69 // --rgid <gid> set real gid
70 // --egid <gid> set effective gid
71 // --reuid <uid> set real and effective uid
72 // --regid <gid> set real and effective gid
73 // --clear-groups clear supplementary groups
74 // --keep-groups keep supplementary groups
75 // --groups <group,...> set supplementary groups
76 // --securebits <bits> set securebits
77 // --selinux-label <label> set SELinux label
78 // --apparmor-profile <pr> set AppArmor profile
79
80 #if ENABLE_FEATURE_SETPRIV_CAPABILITIES
81 #include <linux/capability.h>
82 // #include <sys/capability.h>
83 // This header is in libcap, but the functions are in libc.
84 // Comment in the header says this above capset/capget:
85 /* system calls - look to libc for function to system call mapping */
86 extern int capset(cap_user_header_t header, cap_user_data_t data);
87 extern int capget(cap_user_header_t header, const cap_user_data_t data);
88 // so for bbox, let's just repeat the declarations.
89 // This way, libcap needs not be installed in build environment.
90 #endif
91 #include <sys/prctl.h>
92 #include "libbb.h"
93
94 #ifndef PR_CAPBSET_READ
95 #define PR_CAPBSET_READ 23
96 #endif
97
98 #ifndef PR_SET_NO_NEW_PRIVS
99 #define PR_SET_NO_NEW_PRIVS 38
100 #endif
101
102 #ifndef PR_GET_NO_NEW_PRIVS
103 #define PR_GET_NO_NEW_PRIVS 39
104 #endif
105
106 #ifndef PR_CAP_AMBIENT
107 #define PR_CAP_AMBIENT 47
108 #define PR_CAP_AMBIENT_IS_SET 1
109 #define PR_CAP_AMBIENT_RAISE 2
110 #define PR_CAP_AMBIENT_LOWER 3
111 #endif
112
113 enum {
114 IF_FEATURE_SETPRIV_DUMP(OPTBIT_DUMP,)
115 IF_FEATURE_SETPRIV_CAPABILITIES(OPTBIT_INH,)
116 IF_FEATURE_SETPRIV_CAPABILITIES(OPTBIT_AMB,)
117 OPTBIT_NNP,
118
119 IF_FEATURE_SETPRIV_DUMP(OPT_DUMP = (1 << OPTBIT_DUMP),)
120 IF_FEATURE_SETPRIV_CAPABILITIES(OPT_INH = (1 << OPTBIT_INH),)
121 IF_FEATURE_SETPRIV_CAPABILITIES(OPT_AMB = (1 << OPTBIT_AMB),)
122 OPT_NNP = (1 << OPTBIT_NNP),
123 };
124
125 #if ENABLE_FEATURE_SETPRIV_CAPABILITIES
126 DEFINE_STRUCT_CAPS;
127
parse_cap(const char * cap)128 static unsigned parse_cap(const char *cap)
129 {
130 switch (cap[0]) {
131 case '-':
132 break;
133 case '+':
134 break;
135 default:
136 bb_error_msg_and_die("invalid capability '%s'", cap);
137 break;
138 }
139
140 cap++;
141 return cap_name_to_number(cap);
142 }
143
set_inh_caps(char * capstring)144 static void set_inh_caps(char *capstring)
145 {
146 struct caps caps;
147 char *string;
148
149 getcaps(&caps);
150
151 capstring = strtok_r(capstring, ",", &string);
152 while (capstring) {
153 unsigned cap;
154
155 cap = parse_cap(capstring);
156 if (CAP_TO_INDEX(cap) >= caps.u32s)
157 bb_error_msg_and_die("invalid capability '%s'", capstring);
158
159 if (capstring[0] == '+')
160 caps.data[CAP_TO_INDEX(cap)].inheritable |= CAP_TO_MASK(cap);
161 else
162 caps.data[CAP_TO_INDEX(cap)].inheritable &= ~CAP_TO_MASK(cap);
163 capstring = strtok_r(NULL, ",", &string);
164 }
165
166 if (capset(&caps.header, caps.data) != 0)
167 bb_simple_perror_msg_and_die("capset");
168 }
169
set_ambient_caps(char * string)170 static void set_ambient_caps(char *string)
171 {
172 char *cap;
173
174 cap = strtok_r(string, ",", &string);
175 while (cap) {
176 unsigned idx;
177
178 idx = parse_cap(cap);
179 if (cap[0] == '+') {
180 if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, idx, 0, 0) < 0)
181 bb_simple_perror_msg("cap_ambient_raise");
182 } else {
183 if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_LOWER, idx, 0, 0) < 0)
184 bb_simple_perror_msg("cap_ambient_lower");
185 }
186 cap = strtok_r(NULL, ",", &string);
187 }
188 }
189 #endif /* FEATURE_SETPRIV_CAPABILITIES */
190
191 #if ENABLE_FEATURE_SETPRIV_DUMP
192 # if !ENABLE_FEATURE_SETPRIV_CAPABILITY_NAMES
193 # define printf_cap(pfx, cap_no) printf("%scap_%u", (pfx), (cap_no))
194 # endif
195
dump(void)196 static int dump(void)
197 {
198 IF_FEATURE_SETPRIV_CAPABILITIES(struct caps caps;)
199 const char *fmt;
200 uid_t ruid, euid, suid;
201 gid_t rgid, egid, sgid;
202 gid_t *gids;
203 int i, ngids, nnp;
204
205 getresuid(&ruid, &euid, &suid); /* never fails in Linux */
206 getresgid(&rgid, &egid, &sgid); /* never fails in Linux */
207 ngids = 0;
208 gids = bb_getgroups(&ngids, NULL); /* never fails in Linux */
209
210 nnp = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
211 if (nnp < 0)
212 bb_perror_msg_and_die("prctl: %s", "GET_NO_NEW_PRIVS");
213
214 printf("uid: %u\n", (unsigned)ruid);
215 printf("euid: %u\n", (unsigned)euid);
216 printf("gid: %u\n", (unsigned)rgid);
217 printf("egid: %u\n", (unsigned)egid);
218
219 printf("Supplementary groups: ");
220 if (ngids == 0) {
221 printf("[none]");
222 } else {
223 fmt = ",%u" + 1;
224 for (i = 0; i < ngids; i++) {
225 printf(fmt, (unsigned)gids[i]);
226 fmt = ",%u";
227 }
228 }
229 printf("\nno_new_privs: %d\n", nnp);
230
231 # if ENABLE_FEATURE_SETPRIV_CAPABILITIES
232 getcaps(&caps);
233 printf("Inheritable capabilities: ");
234 fmt = "";
235 for (i = 0; cap_valid(i); i++) {
236 unsigned idx = CAP_TO_INDEX(i);
237 if (idx >= caps.u32s) {
238 printf("\nindex: %u u32s: %u capability: %u\n", idx, caps.u32s, i);
239 bb_simple_error_msg_and_die("unsupported capability");
240 }
241 if (caps.data[idx].inheritable & CAP_TO_MASK(i)) {
242 printf_cap(fmt, i);
243 fmt = ",";
244 }
245 }
246 if (!fmt[0])
247 printf("[none]");
248
249 printf("\nAmbient capabilities: ");
250 fmt = "";
251 for (i = 0; cap_valid(i); i++) {
252 int ret = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, (unsigned long) i, 0UL, 0UL);
253 if (ret < 0)
254 bb_perror_msg_and_die("prctl: %s", "CAP_AMBIENT_IS_SET");
255 if (ret) {
256 printf_cap(fmt, i);
257 fmt = ",";
258 }
259 }
260 if (i == 0)
261 printf("[unsupported]");
262 else if (!fmt[0])
263 printf("[none]");
264
265 printf("\nCapability bounding set: ");
266 fmt = "";
267 for (i = 0; cap_valid(i); i++) {
268 int ret = prctl(PR_CAPBSET_READ, (unsigned long) i, 0UL, 0UL, 0UL);
269 if (ret < 0)
270 bb_perror_msg_and_die("prctl: %s", "CAPBSET_READ");
271 if (ret) {
272 printf_cap(fmt, i);
273 fmt = ",";
274 }
275 }
276 if (!fmt[0])
277 printf("[none]");
278 bb_putchar('\n');
279 # endif
280
281 if (ENABLE_FEATURE_CLEAN_UP)
282 free(gids);
283
284 return EXIT_SUCCESS;
285 }
286 #endif /* FEATURE_SETPRIV_DUMP */
287
288 int setpriv_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
setpriv_main(int argc UNUSED_PARAM,char ** argv)289 int setpriv_main(int argc UNUSED_PARAM, char **argv)
290 {
291 static const char setpriv_longopts[] ALIGN1 =
292 IF_FEATURE_SETPRIV_DUMP(
293 "dump\0" No_argument "d"
294 )
295 "nnp\0" No_argument "\xff"
296 "no-new-privs\0" No_argument "\xff"
297 IF_FEATURE_SETPRIV_CAPABILITIES(
298 "inh-caps\0" Required_argument "\xfe"
299 "ambient-caps\0" Required_argument "\xfd"
300 )
301 ;
302 int opts;
303 IF_FEATURE_SETPRIV_CAPABILITIES(char *inh_caps, *ambient_caps;)
304
305 opts = getopt32long(argv, "+"
306 IF_FEATURE_SETPRIV_DUMP("d")
307 IF_FEATURE_SETPRIV_CAPABILITIES("\xfe:\xfd:"),
308 setpriv_longopts
309 IF_FEATURE_SETPRIV_CAPABILITIES(, &inh_caps, &ambient_caps)
310 );
311 argv += optind;
312
313 #if ENABLE_FEATURE_SETPRIV_DUMP
314 if (opts & OPT_DUMP) {
315 if (argv[0] || (opts - OPT_DUMP) != 0)
316 bb_show_usage();
317 return dump();
318 }
319 #endif
320 if (opts & OPT_NNP) {
321 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
322 bb_perror_msg_and_die("prctl: %s", "SET_NO_NEW_PRIVS");
323 }
324
325 #if ENABLE_FEATURE_SETPRIV_CAPABILITIES
326 if (opts & OPT_INH)
327 set_inh_caps(inh_caps);
328 if (opts & OPT_AMB)
329 set_ambient_caps(ambient_caps);
330 #endif
331
332 if (!argv[0])
333 bb_show_usage();
334 BB_EXECVP_or_die(argv);
335 }
336