/*
* Copyright (c) 1999,2007,2019 Andrew G. Morgan <morgan@kernel.org>
*
* The purpose of this module is to enforce inheritable, bounding and
* ambient capability sets for a specified user.
*/
/* #define DEBUG */
#include <errno.h>
#include <grp.h>
#include <limits.h>
#include <pwd.h>
#include <stdarg.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <syslog.h>
#include <sys/capability.h>
#include <sys/types.h>
#include <security/pam_modules.h>
#include <security/_pam_macros.h>
#define USER_CAP_FILE "/etc/security/capability.conf"
#define CAP_FILE_BUFFER_SIZE 4096
#define CAP_FILE_DELIMITERS " \t\n"
struct pam_cap_s {
int debug;
const char *user;
const char *conf_filename;
};
/*
* load_groups obtains the list all of the groups associated with the
* requested user: gid & supplemental groups.
*/
static int load_groups(const char *user, char ***groups, int *groups_n) {
struct passwd *pwd;
gid_t grps[NGROUPS_MAX];
int ngrps = NGROUPS_MAX;
*groups = NULL;
*groups_n = 0;
pwd = getpwnam(user);
if (pwd == NULL) {
return -1;
}
/* must include at least pwd->pw_gid, hence < 1 test. */
if (getgrouplist(user, pwd->pw_gid, grps, &ngrps) < 1) {
return -1;
}
*groups = calloc(ngrps, sizeof(char *));
int g_n = 0;
for (int i = 0; i < ngrps; i++) {
const struct group *g = getgrgid(grps[i]);
if (g == NULL) {
continue;
}
D(("noting [%s] is a member of [%s]", user, g->gr_name));
(*groups)[g_n++] = strdup(g->gr_name);
}
*groups_n = g_n;
return 0;
}
/* obtain the inheritable capabilities for the current user */
static char *read_capabilities_for_user(const char *user, const char *source)
{
char *cap_string = NULL;
char buffer[CAP_FILE_BUFFER_SIZE], *line;
char **groups;
int groups_n;
FILE *cap_file;
if (load_groups(user, &groups, &groups_n)) {
D(("unknown user [%s]", user));
return NULL;
}
cap_file = fopen(source, "r");
if (cap_file == NULL) {
D(("failed to open capability file"));
goto defer;
}
int found_one = 0;
while (!found_one &&
(line = fgets(buffer, CAP_FILE_BUFFER_SIZE, cap_file))) {
const char *cap_text;
char *next = NULL;
cap_text = strtok_r(line, CAP_FILE_DELIMITERS, &next);
if (cap_text == NULL) {
D(("empty line"));
continue;
}
if (*cap_text == '#') {
D(("comment line"));
continue;
}
/*
* Explore whether any of the ids are a match for the current
* user.
*/
while ((line = strtok_r(next, CAP_FILE_DELIMITERS, &next))) {
if (strcmp("*", line) == 0) {
D(("wildcard matched"));
found_one = 1;
break;
}
if (strcmp(user, line) == 0) {
D(("exact match for user"));
found_one = 1;
break;
}
if (line[0] != '@') {
D(("user [%s] is not [%s] - skipping", user, line));
}
for (int i=0; i < groups_n; i++) {
if (!strcmp(groups[i], line+1)) {
D(("user group matched [%s]", line));
found_one = 1;
break;
}
}
if (found_one) {
break;
}
}
if (found_one) {
cap_string = strdup(cap_text);
D(("user [%s] matched - caps are [%s]", user, cap_string));
}
cap_text = NULL;
line = NULL;
}
fclose(cap_file);
defer:
memset(buffer, 0, CAP_FILE_BUFFER_SIZE);
for (int i = 0; i < groups_n; i++) {
char *g = groups[i];
_pam_overwrite(g);
_pam_drop(g);
}
if (groups != NULL) {
memset(groups, 0, groups_n * sizeof(char *));
_pam_drop(groups);
}
return cap_string;
}
/*
* Set capabilities for current process to match the current
* permitted+executable sets combined with the configured inheritable
* set.
*/
static int set_capabilities(struct pam_cap_s *cs)
{
cap_t cap_s;
char *conf_caps;
int ok = 0;
int has_ambient = 0, has_bound = 0;
int *bound = NULL, *ambient = NULL;
cap_flag_value_t had_setpcap = 0;
cap_value_t max_caps = 0;
const cap_value_t wanted_caps[] = { CAP_SETPCAP };
cap_s = cap_get_proc();
if (cap_s == NULL) {
D(("your kernel is capability challenged - upgrade: %s",
strerror(errno)));
return 0;
}
if (cap_get_flag(cap_s, CAP_SETPCAP, CAP_EFFECTIVE, &had_setpcap)) {
D(("failed to read a e capability: %s", strerror(errno)));
goto cleanup_cap_s;
}
if (cap_set_flag(cap_s, CAP_EFFECTIVE, 1, wanted_caps, CAP_SET) != 0) {
D(("unable to raise CAP_SETPCAP: %s", strerrno(errno)));
goto cleanup_cap_s;
}
conf_caps = read_capabilities_for_user(cs->user,
cs->conf_filename
? cs->conf_filename:USER_CAP_FILE );
if (conf_caps == NULL) {
D(("no capabilities found for user [%s]", cs->user));
goto cleanup_cap_s;
}
ssize_t conf_caps_length = strlen(conf_caps);
if (!strcmp(conf_caps, "all")) {
/*
* all here is interpreted as no change/pass through, which is
* likely to be the same as none for sensible system defaults.
*/
ok = 1;
goto cleanup_caps;
}
if (cap_set_proc(cap_s) != 0) {
D(("unable to use CAP_SETPCAP: %s", strerrno(errno)));
goto cleanup_caps;
}
if (cap_reset_ambient() == 0) {
// Ambient set fully declared by this config.
has_ambient = 1;
}
if (!strcmp(conf_caps, "none")) {
/* clearing CAP_INHERITABLE will also clear the ambient caps. */
cap_clear_flag(cap_s, CAP_INHERITABLE);
} else {
/*
* we know we have to perform some capability operations and
* we need to know how many capabilities there are to do it
* successfully.
*/
while (cap_get_bound(max_caps) >= 0) {
max_caps++;
}
has_bound = (max_caps != 0);
if (has_bound) {
bound = calloc(max_caps, sizeof(int));
if (has_ambient) {
// In kernel lineage, bound came first.
ambient = calloc(max_caps, sizeof(int));
}
}
/*
* Scan the configured capability string for:
*
* cap_name: add to cap_s' inheritable vector
* ^cap_name: add to cap_s' inheritable vector and ambient set
* !cap_name: drop from bounding set
*
* Setting ambient capabilities requires that we first enable
* the corresponding inheritable capability to set them. So,
* there is an order we use: parse the config line, building
* the inheritable, ambient and bounding sets in three separate
* arrays. Then, set I set A set B. Finally, at the end, we
* restore the E value for CAP_SETPCAP.
*/
char *token = NULL;
char *next = conf_caps;
while ((token = strtok_r(next, ",", &next))) {
if (strlen(token) < 4) {
D(("bogus cap: [%s] - ignored\n", token));
goto cleanup_caps;
}
int is_a = 0, is_b = 0;
if (*token == '^') {
if (!has_ambient) {
D(("want ambient [%s] but kernel has no support", token));
goto cleanup_caps;
}
is_a = 1;
token++;
} else if (*token == '!') {
if (!has_bound) {
D(("want bound [%s] dropped - no kernel support", token));
}
is_b = 1;
token++;
}
cap_value_t c;
if (cap_from_name(token, &c) != 0) {
D(("unrecognized name [%s]: %s - ignored", token,
strerror(errno)));
goto cleanup_caps;
}
if (is_b) {
bound[c] = 1;
} else {
if (cap_set_flag(cap_s, CAP_INHERITABLE, 1, &c, CAP_SET)) {
D(("failed to raise inheritable [%s]: %s", token,
strerror(errno)));
goto cleanup_caps;
}
if (is_a) {
ambient[c] = 1;
}
}
}
#ifdef DEBUG
{
char *temp = cap_to_text(cap_s, NULL);
D(("abbreviated caps for process will be [%s]", temp));
cap_free(temp);
}
#endif /* DEBUG */
}
if (cap_set_proc(cap_s)) {
D(("failed to set specified capabilities: %s", strerror(errno)));
} else {
for (cap_value_t c = 0; c < max_caps; c++) {
if (ambient != NULL && ambient[c]) {
cap_set_ambient(c, CAP_SET);
}
if (bound != NULL && bound[c]) {
cap_drop_bound(c);
}
}
ok = 1;
}
cleanup_caps:
if (has_ambient) {
memset(ambient, 0, max_caps * sizeof(*ambient));
_pam_drop(ambient);
ambient = NULL;
}
if (has_bound) {
memset(bound, 0, max_caps * sizeof(*bound));
_pam_drop(bound);
bound = NULL;
}
memset(conf_caps, 0, conf_caps_length);
_pam_drop(conf_caps);
cleanup_cap_s:
if (!had_setpcap) {
/* Only need to lower if it wasn't raised by caller */
if (!cap_set_flag(cap_s, CAP_EFFECTIVE, 1, wanted_caps,
CAP_CLEAR)) {
cap_set_proc(cap_s);
}
}
if (cap_s) {
cap_free(cap_s);
cap_s = NULL;
}
return ok;
}
/* log errors */
static void _pam_log(int err, const char *format, ...)
{
va_list args;
va_start(args, format);
openlog("pam_cap", LOG_CONS|LOG_PID, LOG_AUTH);
vsyslog(err, format, args);
va_end(args);
closelog();
}
static void parse_args(int argc, const char **argv, struct pam_cap_s *pcs)
{
/* step through arguments */
for (; argc-- > 0; ++argv) {
if (!strcmp(*argv, "debug")) {
pcs->debug = 1;
} else if (!memcmp(*argv, "config=", 7)) {
pcs->conf_filename = 7 + *argv;
} else {
_pam_log(LOG_ERR, "unknown option; %s", *argv);
}
}
}
/*
* pam_sm_authenticate parses the config file with respect to the user
* being authenticated and determines if they are covered by any
* capability inheritance rules.
*/
int pam_sm_authenticate(pam_handle_t *pamh, int flags,
int argc, const char **argv)
{
int retval;
struct pam_cap_s pcs;
char *conf_caps;
memset(&pcs, 0, sizeof(pcs));
parse_args(argc, argv, &pcs);
retval = pam_get_user(pamh, &pcs.user, NULL);
if (retval == PAM_CONV_AGAIN) {
D(("user conversation is not available yet"));
memset(&pcs, 0, sizeof(pcs));
return PAM_INCOMPLETE;
}
if (retval != PAM_SUCCESS) {
D(("pam_get_user failed: %s", pam_strerror(pamh, retval)));
memset(&pcs, 0, sizeof(pcs));
return PAM_AUTH_ERR;
}
conf_caps = read_capabilities_for_user(pcs.user,
pcs.conf_filename
? pcs.conf_filename:USER_CAP_FILE );
memset(&pcs, 0, sizeof(pcs));
if (conf_caps) {
D(("it appears that there are capabilities for this user [%s]",
conf_caps));
/* We could also store this as a pam_[gs]et_data item for use
by the setcred call to follow. As it is, there is a small
race associated with a redundant read. Oh well, if you
care, send me a patch.. */
_pam_overwrite(conf_caps);
_pam_drop(conf_caps);
return PAM_SUCCESS;
} else {
D(("there are no capabilities restrctions on this user"));
return PAM_IGNORE;
}
}
/*
* pam_sm_setcred applies inheritable capabilities loaded by the
* pam_sm_authenticate pass for the user.
*/
int pam_sm_setcred(pam_handle_t *pamh, int flags,
int argc, const char **argv)
{
int retval;
struct pam_cap_s pcs;
if (!(flags & (PAM_ESTABLISH_CRED | PAM_REINITIALIZE_CRED))) {
D(("we don't handle much in the way of credentials"));
return PAM_IGNORE;
}
memset(&pcs, 0, sizeof(pcs));
parse_args(argc, argv, &pcs);
retval = pam_get_item(pamh, PAM_USER, (const void **)&pcs.user);
if ((retval != PAM_SUCCESS) || (pcs.user == NULL) || !(pcs.user[0])) {
D(("user's name is not set"));
return PAM_AUTH_ERR;
}
retval = set_capabilities(&pcs);
memset(&pcs, 0, sizeof(pcs));
return (retval ? PAM_SUCCESS:PAM_IGNORE );
}