77216c368f
Various tools are Linuxish and should thus only attempted to build on Linux only. Some features are also Linux-only. Also, libresolv is used on all GNU platforms, notably GNU/Hurd and GNU/kfreeBSD. Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org> Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
337 lines
9.2 KiB
C
337 lines
9.2 KiB
C
/* vi: set sw=4 ts=4: */
|
|
/*
|
|
* setpriv implementation for busybox based on linux-utils-ng 2.29
|
|
*
|
|
* Copyright (C) 2017 by <assafgordon@gmail.com>
|
|
*
|
|
* Licensed under GPLv2 or later, see file LICENSE in this source tree.
|
|
*/
|
|
//config:config SETPRIV
|
|
//config: bool "setpriv (6.6 kb)"
|
|
//config: default y
|
|
//config: select PLATFORM_LINUX
|
|
//config: select LONG_OPTS
|
|
//config: help
|
|
//config: Run a program with different Linux privilege settings.
|
|
//config: Requires kernel >= 3.5
|
|
//config:
|
|
//config:config FEATURE_SETPRIV_DUMP
|
|
//config: bool "Support dumping current privilege state"
|
|
//config: default y
|
|
//config: depends on SETPRIV
|
|
//config: help
|
|
//config: Enables the "--dump" switch to print out the current privilege
|
|
//config: state. This is helpful for diagnosing problems.
|
|
//config:
|
|
//config:config FEATURE_SETPRIV_CAPABILITIES
|
|
//config: bool "Support capabilities"
|
|
//config: default y
|
|
//config: depends on SETPRIV
|
|
//config: help
|
|
//config: Capabilities can be used to grant processes additional rights
|
|
//config: without the necessity to always execute as the root user.
|
|
//config: Enabling this option enables "--dump" to show information on
|
|
//config: capabilities.
|
|
//config:
|
|
//config:config FEATURE_SETPRIV_CAPABILITY_NAMES
|
|
//config: bool "Support capability names"
|
|
//config: default y
|
|
//config: depends on SETPRIV && FEATURE_SETPRIV_CAPABILITIES
|
|
//config: help
|
|
//config: Capabilities can be either referenced via a human-readble name,
|
|
//config: e.g. "net_admin", or using their index, e.g. "cap_12". Enabling
|
|
//config: this option allows using the human-readable names in addition to
|
|
//config: the index-based names.
|
|
|
|
//applet:IF_SETPRIV(APPLET(setpriv, BB_DIR_BIN, BB_SUID_DROP))
|
|
|
|
//kbuild:lib-$(CONFIG_SETPRIV) += setpriv.o
|
|
|
|
//usage:#define setpriv_trivial_usage
|
|
//usage: "[OPTIONS] PROG ARGS"
|
|
//usage:#define setpriv_full_usage "\n\n"
|
|
//usage: "Run PROG with different privilege settings\n"
|
|
//usage: IF_FEATURE_SETPRIV_DUMP(
|
|
//usage: "\n-d,--dump Show current capabilities"
|
|
//usage: )
|
|
//usage: "\n--nnp,--no-new-privs Ignore setuid/setgid bits and file capabilities"
|
|
//usage: IF_FEATURE_SETPRIV_CAPABILITIES(
|
|
//usage: "\n--inh-caps CAP,CAP Set inheritable capabilities"
|
|
//usage: "\n--ambient-caps CAP,CAP Set ambient capabilities"
|
|
//usage: )
|
|
|
|
//setpriv from util-linux 2.28:
|
|
// -d, --dump show current state (and do not exec anything)
|
|
// --nnp, --no-new-privs disallow granting new privileges
|
|
// --inh-caps <caps,...> set inheritable capabilities
|
|
// --bounding-set <caps> set capability bounding set
|
|
// --ruid <uid> set real uid
|
|
// --euid <uid> set effective uid
|
|
// --rgid <gid> set real gid
|
|
// --egid <gid> set effective gid
|
|
// --reuid <uid> set real and effective uid
|
|
// --regid <gid> set real and effective gid
|
|
// --clear-groups clear supplementary groups
|
|
// --keep-groups keep supplementary groups
|
|
// --groups <group,...> set supplementary groups
|
|
// --securebits <bits> set securebits
|
|
// --selinux-label <label> set SELinux label
|
|
// --apparmor-profile <pr> set AppArmor profile
|
|
|
|
#if ENABLE_FEATURE_SETPRIV_CAPABILITIES
|
|
#include <linux/capability.h>
|
|
// #include <sys/capability.h>
|
|
// This header is in libcap, but the functions are in libc.
|
|
// Comment in the header says this above capset/capget:
|
|
/* system calls - look to libc for function to system call mapping */
|
|
extern int capset(cap_user_header_t header, cap_user_data_t data);
|
|
extern int capget(cap_user_header_t header, const cap_user_data_t data);
|
|
// so for bbox, let's just repeat the declarations.
|
|
// This way, libcap needs not be installed in build environment.
|
|
#endif
|
|
#include <sys/prctl.h>
|
|
#include "libbb.h"
|
|
|
|
#ifndef PR_CAPBSET_READ
|
|
#define PR_CAPBSET_READ 23
|
|
#endif
|
|
|
|
#ifndef PR_SET_NO_NEW_PRIVS
|
|
#define PR_SET_NO_NEW_PRIVS 38
|
|
#endif
|
|
|
|
#ifndef PR_GET_NO_NEW_PRIVS
|
|
#define PR_GET_NO_NEW_PRIVS 39
|
|
#endif
|
|
|
|
#ifndef PR_CAP_AMBIENT
|
|
#define PR_CAP_AMBIENT 47
|
|
#define PR_CAP_AMBIENT_IS_SET 1
|
|
#define PR_CAP_AMBIENT_RAISE 2
|
|
#define PR_CAP_AMBIENT_LOWER 3
|
|
#endif
|
|
|
|
enum {
|
|
IF_FEATURE_SETPRIV_DUMP(OPTBIT_DUMP,)
|
|
IF_FEATURE_SETPRIV_CAPABILITIES(OPTBIT_INH,)
|
|
IF_FEATURE_SETPRIV_CAPABILITIES(OPTBIT_AMB,)
|
|
OPTBIT_NNP,
|
|
|
|
IF_FEATURE_SETPRIV_DUMP(OPT_DUMP = (1 << OPTBIT_DUMP),)
|
|
IF_FEATURE_SETPRIV_CAPABILITIES(OPT_INH = (1 << OPTBIT_INH),)
|
|
IF_FEATURE_SETPRIV_CAPABILITIES(OPT_AMB = (1 << OPTBIT_AMB),)
|
|
OPT_NNP = (1 << OPTBIT_NNP),
|
|
};
|
|
|
|
#if ENABLE_FEATURE_SETPRIV_CAPABILITIES
|
|
DEFINE_STRUCT_CAPS;
|
|
|
|
static unsigned parse_cap(const char *cap)
|
|
{
|
|
switch (cap[0]) {
|
|
case '-':
|
|
break;
|
|
case '+':
|
|
break;
|
|
default:
|
|
bb_error_msg_and_die("invalid capability '%s'", cap);
|
|
break;
|
|
}
|
|
|
|
cap++;
|
|
return cap_name_to_number(cap);
|
|
}
|
|
|
|
static void set_inh_caps(char *capstring)
|
|
{
|
|
struct caps caps;
|
|
char *string;
|
|
|
|
getcaps(&caps);
|
|
|
|
capstring = strtok_r(capstring, ",", &string);
|
|
while (capstring) {
|
|
unsigned cap;
|
|
|
|
cap = parse_cap(capstring);
|
|
if (CAP_TO_INDEX(cap) >= caps.u32s)
|
|
bb_error_msg_and_die("invalid capability '%s'", capstring);
|
|
|
|
if (capstring[0] == '+')
|
|
caps.data[CAP_TO_INDEX(cap)].inheritable |= CAP_TO_MASK(cap);
|
|
else
|
|
caps.data[CAP_TO_INDEX(cap)].inheritable &= ~CAP_TO_MASK(cap);
|
|
capstring = strtok_r(NULL, ",", &string);
|
|
}
|
|
|
|
if (capset(&caps.header, caps.data) != 0)
|
|
bb_simple_perror_msg_and_die("capset");
|
|
}
|
|
|
|
static void set_ambient_caps(char *string)
|
|
{
|
|
char *cap;
|
|
|
|
cap = strtok_r(string, ",", &string);
|
|
while (cap) {
|
|
unsigned idx;
|
|
|
|
idx = parse_cap(cap);
|
|
if (cap[0] == '+') {
|
|
if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, idx, 0, 0) < 0)
|
|
bb_simple_perror_msg("cap_ambient_raise");
|
|
} else {
|
|
if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_LOWER, idx, 0, 0) < 0)
|
|
bb_simple_perror_msg("cap_ambient_lower");
|
|
}
|
|
cap = strtok_r(NULL, ",", &string);
|
|
}
|
|
}
|
|
#endif /* FEATURE_SETPRIV_CAPABILITIES */
|
|
|
|
#if ENABLE_FEATURE_SETPRIV_DUMP
|
|
# if !ENABLE_FEATURE_SETPRIV_CAPABILITY_NAMES
|
|
# define printf_cap(pfx, cap_no) printf("%scap_%u", (pfx), (cap_no))
|
|
# endif
|
|
|
|
static int dump(void)
|
|
{
|
|
IF_FEATURE_SETPRIV_CAPABILITIES(struct caps caps;)
|
|
const char *fmt;
|
|
uid_t ruid, euid, suid;
|
|
gid_t rgid, egid, sgid;
|
|
gid_t *gids;
|
|
int i, ngids, nnp;
|
|
|
|
getresuid(&ruid, &euid, &suid); /* never fails in Linux */
|
|
getresgid(&rgid, &egid, &sgid); /* never fails in Linux */
|
|
ngids = 0;
|
|
gids = bb_getgroups(&ngids, NULL); /* never fails in Linux */
|
|
|
|
nnp = prctl(PR_GET_NO_NEW_PRIVS, 0, 0, 0, 0);
|
|
if (nnp < 0)
|
|
bb_perror_msg_and_die("prctl: %s", "GET_NO_NEW_PRIVS");
|
|
|
|
printf("uid: %u\n", (unsigned)ruid);
|
|
printf("euid: %u\n", (unsigned)euid);
|
|
printf("gid: %u\n", (unsigned)rgid);
|
|
printf("egid: %u\n", (unsigned)egid);
|
|
|
|
printf("Supplementary groups: ");
|
|
if (ngids == 0) {
|
|
printf("[none]");
|
|
} else {
|
|
fmt = ",%u" + 1;
|
|
for (i = 0; i < ngids; i++) {
|
|
printf(fmt, (unsigned)gids[i]);
|
|
fmt = ",%u";
|
|
}
|
|
}
|
|
printf("\nno_new_privs: %d\n", nnp);
|
|
|
|
# if ENABLE_FEATURE_SETPRIV_CAPABILITIES
|
|
getcaps(&caps);
|
|
printf("Inheritable capabilities: ");
|
|
fmt = "";
|
|
for (i = 0; cap_valid(i); i++) {
|
|
unsigned idx = CAP_TO_INDEX(i);
|
|
if (idx >= caps.u32s) {
|
|
printf("\nindex: %u u32s: %u capability: %u\n", idx, caps.u32s, i);
|
|
bb_simple_error_msg_and_die("unsupported capability");
|
|
}
|
|
if (caps.data[idx].inheritable & CAP_TO_MASK(i)) {
|
|
printf_cap(fmt, i);
|
|
fmt = ",";
|
|
}
|
|
}
|
|
if (!fmt[0])
|
|
printf("[none]");
|
|
|
|
printf("\nAmbient capabilities: ");
|
|
fmt = "";
|
|
for (i = 0; cap_valid(i); i++) {
|
|
int ret = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_IS_SET, (unsigned long) i, 0UL, 0UL);
|
|
if (ret < 0)
|
|
bb_perror_msg_and_die("prctl: %s", "CAP_AMBIENT_IS_SET");
|
|
if (ret) {
|
|
printf_cap(fmt, i);
|
|
fmt = ",";
|
|
}
|
|
}
|
|
if (i == 0)
|
|
printf("[unsupported]");
|
|
else if (!fmt[0])
|
|
printf("[none]");
|
|
|
|
printf("\nCapability bounding set: ");
|
|
fmt = "";
|
|
for (i = 0; cap_valid(i); i++) {
|
|
int ret = prctl(PR_CAPBSET_READ, (unsigned long) i, 0UL, 0UL, 0UL);
|
|
if (ret < 0)
|
|
bb_perror_msg_and_die("prctl: %s", "CAPBSET_READ");
|
|
if (ret) {
|
|
printf_cap(fmt, i);
|
|
fmt = ",";
|
|
}
|
|
}
|
|
if (!fmt[0])
|
|
printf("[none]");
|
|
bb_putchar('\n');
|
|
# endif
|
|
|
|
if (ENABLE_FEATURE_CLEAN_UP)
|
|
free(gids);
|
|
|
|
return EXIT_SUCCESS;
|
|
}
|
|
#endif /* FEATURE_SETPRIV_DUMP */
|
|
|
|
int setpriv_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
|
|
int setpriv_main(int argc UNUSED_PARAM, char **argv)
|
|
{
|
|
static const char setpriv_longopts[] ALIGN1 =
|
|
IF_FEATURE_SETPRIV_DUMP(
|
|
"dump\0" No_argument "d"
|
|
)
|
|
"nnp\0" No_argument "\xff"
|
|
"no-new-privs\0" No_argument "\xff"
|
|
IF_FEATURE_SETPRIV_CAPABILITIES(
|
|
"inh-caps\0" Required_argument "\xfe"
|
|
"ambient-caps\0" Required_argument "\xfd"
|
|
)
|
|
;
|
|
int opts;
|
|
IF_FEATURE_SETPRIV_CAPABILITIES(char *inh_caps, *ambient_caps;)
|
|
|
|
opts = getopt32long(argv, "+"
|
|
IF_FEATURE_SETPRIV_DUMP("d")
|
|
IF_FEATURE_SETPRIV_CAPABILITIES("\xfe:\xfd:"),
|
|
setpriv_longopts
|
|
IF_FEATURE_SETPRIV_CAPABILITIES(, &inh_caps, &ambient_caps)
|
|
);
|
|
argv += optind;
|
|
|
|
#if ENABLE_FEATURE_SETPRIV_DUMP
|
|
if (opts & OPT_DUMP) {
|
|
if (argv[0] || (opts - OPT_DUMP) != 0)
|
|
bb_show_usage();
|
|
return dump();
|
|
}
|
|
#endif
|
|
if (opts & OPT_NNP) {
|
|
if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0))
|
|
bb_perror_msg_and_die("prctl: %s", "SET_NO_NEW_PRIVS");
|
|
}
|
|
|
|
#if ENABLE_FEATURE_SETPRIV_CAPABILITIES
|
|
if (opts & OPT_INH)
|
|
set_inh_caps(inh_caps);
|
|
if (opts & OPT_AMB)
|
|
set_ambient_caps(ambient_caps);
|
|
#endif
|
|
|
|
if (!argv[0])
|
|
bb_show_usage();
|
|
BB_EXECVP_or_die(argv);
|
|
}
|