1/*-
2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
3 *
4 * Copyright (c) 2013 FreeBSD Foundation
5 * All rights reserved.
6 *
7 * This software was developed by Pawel Jakub Dawidek under sponsorship from
8 * the FreeBSD Foundation.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 *    notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 *    notice, this list of conditions and the following disclaimer in the
17 *    documentation and/or other materials provided with the distribution.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32#include <sys/cdefs.h>
33__FBSDID("$FreeBSD$");
34
35/*
36 * Note that this file is compiled into the kernel and into libc.
37 */
38
39#include <sys/types.h>
40#include <sys/capsicum.h>
41
42#ifdef _KERNEL
43#include <sys/systm.h>
44#include <sys/kernel.h>
45#include <machine/stdarg.h>
46#else	/* !_KERNEL */
47#include <assert.h>
48#include <stdarg.h>
49#include <stdbool.h>
50#include <stdint.h>
51#include <string.h>
52#endif
53
54#ifdef _KERNEL
55#define	assert(exp)	KASSERT((exp), ("%s:%u", __func__, __LINE__))
56__read_mostly cap_rights_t cap_accept_rights;
57__read_mostly cap_rights_t cap_bind_rights;
58__read_mostly cap_rights_t cap_chflags_rights;
59__read_mostly cap_rights_t cap_connect_rights;
60__read_mostly cap_rights_t cap_event_rights;
61__read_mostly cap_rights_t cap_fchdir_rights;
62__read_mostly cap_rights_t cap_fchflags_rights;
63__read_mostly cap_rights_t cap_fchmod_rights;
64__read_mostly cap_rights_t cap_fchown_rights;
65__read_mostly cap_rights_t cap_fcntl_rights;
66__read_mostly cap_rights_t cap_fexecve_rights;
67__read_mostly cap_rights_t cap_flock_rights;
68__read_mostly cap_rights_t cap_fpathconf_rights;
69__read_mostly cap_rights_t cap_fstat_rights;
70__read_mostly cap_rights_t cap_fstatfs_rights;
71__read_mostly cap_rights_t cap_fsync_rights;
72__read_mostly cap_rights_t cap_ftruncate_rights;
73__read_mostly cap_rights_t cap_futimes_rights;
74__read_mostly cap_rights_t cap_getpeername_rights;
75__read_mostly cap_rights_t cap_getsockopt_rights;
76__read_mostly cap_rights_t cap_getsockname_rights;
77__read_mostly cap_rights_t cap_ioctl_rights;
78__read_mostly cap_rights_t cap_listen_rights;
79__read_mostly cap_rights_t cap_linkat_source_rights;
80__read_mostly cap_rights_t cap_linkat_target_rights;
81__read_mostly cap_rights_t cap_mmap_rights;
82__read_mostly cap_rights_t cap_mkdirat_rights;
83__read_mostly cap_rights_t cap_mkfifoat_rights;
84__read_mostly cap_rights_t cap_mknodat_rights;
85__read_mostly cap_rights_t cap_pdgetpid_rights;
86__read_mostly cap_rights_t cap_pdkill_rights;
87__read_mostly cap_rights_t cap_pread_rights;
88__read_mostly cap_rights_t cap_pwrite_rights;
89__read_mostly cap_rights_t cap_read_rights;
90__read_mostly cap_rights_t cap_recv_rights;
91__read_mostly cap_rights_t cap_renameat_source_rights;
92__read_mostly cap_rights_t cap_renameat_target_rights;
93__read_mostly cap_rights_t cap_seek_rights;
94__read_mostly cap_rights_t cap_send_rights;
95__read_mostly cap_rights_t cap_send_connect_rights;
96__read_mostly cap_rights_t cap_setsockopt_rights;
97__read_mostly cap_rights_t cap_shutdown_rights;
98__read_mostly cap_rights_t cap_symlinkat_rights;
99__read_mostly cap_rights_t cap_unlinkat_rights;
100__read_mostly cap_rights_t cap_write_rights;
101__read_mostly cap_rights_t cap_no_rights;
102
103static void
104cap_rights_sysinit(void *arg)
105{
106	cap_rights_init_one(&cap_accept_rights, CAP_ACCEPT);
107	cap_rights_init_one(&cap_bind_rights, CAP_BIND);
108	cap_rights_init_one(&cap_connect_rights, CAP_CONNECT);
109	cap_rights_init_one(&cap_event_rights, CAP_EVENT);
110	cap_rights_init_one(&cap_fchdir_rights, CAP_FCHDIR);
111	cap_rights_init_one(&cap_fchflags_rights, CAP_FCHFLAGS);
112	cap_rights_init_one(&cap_fchmod_rights, CAP_FCHMOD);
113	cap_rights_init_one(&cap_fchown_rights, CAP_FCHOWN);
114	cap_rights_init_one(&cap_fcntl_rights, CAP_FCNTL);
115	cap_rights_init_one(&cap_fexecve_rights, CAP_FEXECVE);
116	cap_rights_init_one(&cap_flock_rights, CAP_FLOCK);
117	cap_rights_init_one(&cap_fpathconf_rights, CAP_FPATHCONF);
118	cap_rights_init_one(&cap_fstat_rights, CAP_FSTAT);
119	cap_rights_init_one(&cap_fstatfs_rights, CAP_FSTATFS);
120	cap_rights_init_one(&cap_fsync_rights, CAP_FSYNC);
121	cap_rights_init_one(&cap_ftruncate_rights, CAP_FTRUNCATE);
122	cap_rights_init_one(&cap_futimes_rights, CAP_FUTIMES);
123	cap_rights_init_one(&cap_getpeername_rights, CAP_GETPEERNAME);
124	cap_rights_init_one(&cap_getsockname_rights, CAP_GETSOCKNAME);
125	cap_rights_init_one(&cap_getsockopt_rights, CAP_GETSOCKOPT);
126	cap_rights_init_one(&cap_ioctl_rights, CAP_IOCTL);
127	cap_rights_init_one(&cap_linkat_source_rights, CAP_LINKAT_SOURCE);
128	cap_rights_init_one(&cap_linkat_target_rights, CAP_LINKAT_TARGET);
129	cap_rights_init_one(&cap_listen_rights, CAP_LISTEN);
130	cap_rights_init_one(&cap_mkdirat_rights, CAP_MKDIRAT);
131	cap_rights_init_one(&cap_mkfifoat_rights, CAP_MKFIFOAT);
132	cap_rights_init_one(&cap_mknodat_rights, CAP_MKNODAT);
133	cap_rights_init_one(&cap_mmap_rights, CAP_MMAP);
134	cap_rights_init_one(&cap_pdgetpid_rights, CAP_PDGETPID);
135	cap_rights_init_one(&cap_pdkill_rights, CAP_PDKILL);
136	cap_rights_init_one(&cap_pread_rights, CAP_PREAD);
137	cap_rights_init_one(&cap_pwrite_rights, CAP_PWRITE);
138	cap_rights_init_one(&cap_read_rights, CAP_READ);
139	cap_rights_init_one(&cap_recv_rights, CAP_RECV);
140	cap_rights_init_one(&cap_renameat_source_rights, CAP_RENAMEAT_SOURCE);
141	cap_rights_init_one(&cap_renameat_target_rights, CAP_RENAMEAT_TARGET);
142	cap_rights_init_one(&cap_seek_rights, CAP_SEEK);
143	cap_rights_init_one(&cap_send_rights, CAP_SEND);
144	cap_rights_init(&cap_send_connect_rights, CAP_SEND, CAP_CONNECT);
145	cap_rights_init_one(&cap_setsockopt_rights, CAP_SETSOCKOPT);
146	cap_rights_init_one(&cap_shutdown_rights, CAP_SHUTDOWN);
147	cap_rights_init_one(&cap_symlinkat_rights, CAP_SYMLINKAT);
148	cap_rights_init_one(&cap_unlinkat_rights, CAP_UNLINKAT);
149	cap_rights_init_one(&cap_write_rights, CAP_WRITE);
150	cap_rights_init(&cap_no_rights);
151}
152SYSINIT(cap_rights_sysinit, SI_SUB_COPYRIGHT, SI_ORDER_ANY, cap_rights_sysinit,
153    NULL);
154
155#endif
156
157#define	CAPARSIZE_MIN	(CAP_RIGHTS_VERSION_00 + 2)
158#define	CAPARSIZE_MAX	(CAP_RIGHTS_VERSION + 2)
159
160static __inline int
161right_to_index(uint64_t right)
162{
163	static const int bit2idx[] = {
164		-1, 0, 1, -1, 2, -1, -1, -1, 3, -1, -1, -1, -1, -1, -1, -1,
165		4, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1
166	};
167	int idx;
168
169	idx = CAPIDXBIT(right);
170	assert(idx >= 0 && idx < sizeof(bit2idx) / sizeof(bit2idx[0]));
171	return (bit2idx[idx]);
172}
173
174static void
175cap_rights_vset(cap_rights_t *rights, va_list ap)
176{
177	uint64_t right;
178	int i, n __unused;
179
180	assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00);
181
182	n = CAPARSIZE(rights);
183	assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX);
184
185	for (;;) {
186		right = (uint64_t)va_arg(ap, unsigned long long);
187		if (right == 0)
188			break;
189		assert(CAPRVER(right) == 0);
190		i = right_to_index(right);
191		assert(i >= 0);
192		assert(i < n);
193		assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right));
194		rights->cr_rights[i] |= right;
195		assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right));
196	}
197}
198
199static void
200cap_rights_vclear(cap_rights_t *rights, va_list ap)
201{
202	uint64_t right;
203	int i, n __unused;
204
205	assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00);
206
207	n = CAPARSIZE(rights);
208	assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX);
209
210	for (;;) {
211		right = (uint64_t)va_arg(ap, unsigned long long);
212		if (right == 0)
213			break;
214		assert(CAPRVER(right) == 0);
215		i = right_to_index(right);
216		assert(i >= 0);
217		assert(i < n);
218		assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right));
219		rights->cr_rights[i] &= ~(right & 0x01FFFFFFFFFFFFFFULL);
220		assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right));
221	}
222}
223
224static bool
225cap_rights_is_vset(const cap_rights_t *rights, va_list ap)
226{
227	uint64_t right;
228	int i, n __unused;
229
230	assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00);
231
232	n = CAPARSIZE(rights);
233	assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX);
234
235	for (;;) {
236		right = (uint64_t)va_arg(ap, unsigned long long);
237		if (right == 0)
238			break;
239		assert(CAPRVER(right) == 0);
240		i = right_to_index(right);
241		assert(i >= 0);
242		assert(i < n);
243		assert(CAPIDXBIT(rights->cr_rights[i]) == CAPIDXBIT(right));
244		if ((rights->cr_rights[i] & right) != right)
245			return (false);
246	}
247
248	return (true);
249}
250
251cap_rights_t *
252__cap_rights_init(int version, cap_rights_t *rights, ...)
253{
254	unsigned int n __unused;
255	va_list ap;
256
257	assert(version == CAP_RIGHTS_VERSION_00);
258
259	n = version + 2;
260	assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX);
261	CAP_NONE(rights);
262	va_start(ap, rights);
263	cap_rights_vset(rights, ap);
264	va_end(ap);
265
266	return (rights);
267}
268
269cap_rights_t *
270__cap_rights_set(cap_rights_t *rights, ...)
271{
272	va_list ap;
273
274	assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00);
275
276	va_start(ap, rights);
277	cap_rights_vset(rights, ap);
278	va_end(ap);
279
280	return (rights);
281}
282
283cap_rights_t *
284__cap_rights_clear(cap_rights_t *rights, ...)
285{
286	va_list ap;
287
288	assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00);
289
290	va_start(ap, rights);
291	cap_rights_vclear(rights, ap);
292	va_end(ap);
293
294	return (rights);
295}
296
297bool
298__cap_rights_is_set(const cap_rights_t *rights, ...)
299{
300	va_list ap;
301	bool ret;
302
303	assert(CAPVER(rights) == CAP_RIGHTS_VERSION_00);
304
305	va_start(ap, rights);
306	ret = cap_rights_is_vset(rights, ap);
307	va_end(ap);
308
309	return (ret);
310}
311
312bool
313cap_rights_is_valid(const cap_rights_t *rights)
314{
315	cap_rights_t allrights;
316	int i, j;
317
318	if (CAPVER(rights) != CAP_RIGHTS_VERSION_00)
319		return (false);
320	if (CAPARSIZE(rights) < CAPARSIZE_MIN ||
321	    CAPARSIZE(rights) > CAPARSIZE_MAX) {
322		return (false);
323	}
324	CAP_ALL(&allrights);
325	if (!cap_rights_contains(&allrights, rights))
326		return (false);
327	for (i = 0; i < CAPARSIZE(rights); i++) {
328		j = right_to_index(rights->cr_rights[i]);
329		if (i != j)
330			return (false);
331		if (i > 0) {
332			if (CAPRVER(rights->cr_rights[i]) != 0)
333				return (false);
334		}
335	}
336
337	return (true);
338}
339
340cap_rights_t *
341cap_rights_merge(cap_rights_t *dst, const cap_rights_t *src)
342{
343	unsigned int i, n;
344
345	assert(CAPVER(dst) == CAP_RIGHTS_VERSION_00);
346	assert(CAPVER(src) == CAP_RIGHTS_VERSION_00);
347	assert(CAPVER(dst) == CAPVER(src));
348	assert(cap_rights_is_valid(src));
349	assert(cap_rights_is_valid(dst));
350
351	n = CAPARSIZE(dst);
352	assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX);
353
354	for (i = 0; i < n; i++)
355		dst->cr_rights[i] |= src->cr_rights[i];
356
357	assert(cap_rights_is_valid(src));
358	assert(cap_rights_is_valid(dst));
359
360	return (dst);
361}
362
363cap_rights_t *
364cap_rights_remove(cap_rights_t *dst, const cap_rights_t *src)
365{
366	unsigned int i, n;
367
368	assert(CAPVER(dst) == CAP_RIGHTS_VERSION_00);
369	assert(CAPVER(src) == CAP_RIGHTS_VERSION_00);
370	assert(CAPVER(dst) == CAPVER(src));
371	assert(cap_rights_is_valid(src));
372	assert(cap_rights_is_valid(dst));
373
374	n = CAPARSIZE(dst);
375	assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX);
376
377	for (i = 0; i < n; i++) {
378		dst->cr_rights[i] &=
379		    ~(src->cr_rights[i] & 0x01FFFFFFFFFFFFFFULL);
380	}
381
382	assert(cap_rights_is_valid(src));
383	assert(cap_rights_is_valid(dst));
384
385	return (dst);
386}
387
388#ifndef _KERNEL
389bool
390cap_rights_contains(const cap_rights_t *big, const cap_rights_t *little)
391{
392	unsigned int i, n;
393
394	assert(CAPVER(big) == CAP_RIGHTS_VERSION_00);
395	assert(CAPVER(little) == CAP_RIGHTS_VERSION_00);
396	assert(CAPVER(big) == CAPVER(little));
397
398	n = CAPARSIZE(big);
399	assert(n >= CAPARSIZE_MIN && n <= CAPARSIZE_MAX);
400
401	for (i = 0; i < n; i++) {
402		if ((big->cr_rights[i] & little->cr_rights[i]) !=
403		    little->cr_rights[i]) {
404			return (false);
405		}
406	}
407
408	return (true);
409}
410#endif
411