use new API
[util-vserver.git] / util-vserver / src / reducecap.c
1 // $Id$
2
3 // Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
4 // based on reducecap.cc by Jacques Gelinas
5 //  
6 // This program is free software; you can redistribute it and/or modify
7 // it under the terms of the GNU General Public License as published by
8 // the Free Software Foundation; either version 2, or (at your option)
9 // any later version.
10 //  
11 // This program is distributed in the hope that it will be useful,
12 // but WITHOUT ANY WARRANTY; without even the implied warranty of
13 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14 // GNU General Public License for more details.
15 //  
16 // You should have received a copy of the GNU General Public License
17 // along with this program; if not, write to the Free Software
18 // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
19
20 #ifdef HAVE_CONFIG_H
21 #  include <config.h>
22 #endif
23 #include "compat.h"
24
25 #include <stdio.h>
26 #include <errno.h>
27 #include <unistd.h>
28 #include <stdlib.h>
29 #include <string.h>
30
31 #include "linuxcaps.h"
32 #include "vserver.h"
33
34 extern int capget (struct __user_cap_header_struct *, struct __user_cap_data_struct *);
35 extern int capset (struct __user_cap_header_struct *, struct __user_cap_data_struct *);
36
37 static void usage()
38 {
39         fprintf (stderr,"reducecap version %s\n",VERSION);
40         fprintf (stderr,"reducecap [ options ] command argument\n");
41         exit (-1);
42 }
43
44 static void reducecap_print(struct __user_cap_data_struct *user)
45 {
46         static const char *tb[]={
47                 "CAP_CHOWN",
48                 "CAP_DAC_OVERRIDE",
49                 "CAP_DAC_READ_SEARCH",
50                 "CAP_FOWNER",
51                 "CAP_FSETID",
52                 "CAP_KILL",
53                 "CAP_SETGID",
54                 "CAP_SETUID",
55                 "CAP_SETPCAP",
56                 "CAP_LINUX_IMMUTABLE",
57                 "CAP_NET_BIND_SERVICE",
58                 "CAP_NET_BROADCAST",
59                 "CAP_NET_ADMIN",
60                 "CAP_NET_RAW",
61                 "CAP_IPC_LOCK",
62                 "CAP_IPC_OWNER",
63                 "CAP_SYS_MODULE",
64                 "CAP_SYS_RAWIO",
65                 "CAP_SYS_CHROOT",
66                 "CAP_SYS_PTRACE",
67                 "CAP_SYS_PACCT",
68                 "CAP_SYS_ADMIN",
69                 "CAP_SYS_BOOT",
70                 "CAP_SYS_NICE",
71                 "CAP_SYS_RESOURCE",
72                 "CAP_SYS_TIME",
73                 "CAP_SYS_TTY_CONFIG",
74                 "CAP_MKNOD",
75                 "CAP_LEASE",
76                 "CAP_OPENDEV",
77                 NULL
78         };
79         int i;
80         printf ("%22s %9s %9s %9s\n","Capability","Effective","Permitted"
81                 ,"Inheritable");
82         for (i=0; tb[i] != NULL; i++){
83                 int bit = (1 << i);
84                 printf ("%22s %9s %9s %9s\n"
85                         ,tb[i]
86                         ,(user->effective & bit) ? "X    " : " "
87                         ,(user->permitted & bit) ? "X    " : " "
88                         ,(user->inheritable & bit) ? "X    " : " ");
89         }
90 }
91
92 static void reducecap_show()
93 {
94         struct __user_cap_header_struct header;
95         struct __user_cap_data_struct user;
96         header.version = _LINUX_CAPABILITY_VERSION;
97         header.pid = getpid();
98         if (capget(&header,&user)==-1){
99                 perror ("capget");
100         }else{
101                 reducecap_print (&user);
102         }
103 }
104
105
106
107 int main (int argc, char *argv[])
108 {
109         int ret = -1;
110         unsigned long remove = 0;
111         int show = 0;
112         int flags = 0;
113         unsigned long secure = (1<<CAP_LINUX_IMMUTABLE)
114                 |(1<<CAP_NET_BROADCAST)
115                 |(1<<CAP_NET_ADMIN)
116                 |(1<<CAP_NET_RAW)
117                 |(1<<CAP_IPC_LOCK)
118                 |(1<<CAP_IPC_OWNER)
119                 |(1<<CAP_SYS_MODULE)
120                 |(1<<CAP_SYS_RAWIO)
121                 |(1<<CAP_SYS_PACCT)
122                 |(1<<CAP_SYS_ADMIN)
123                 |(1<<CAP_SYS_BOOT)
124                 |(1<<CAP_SYS_NICE)
125                 |(1<<CAP_SYS_RESOURCE)
126                 |(1<<CAP_SYS_TIME)
127                 |(1<<CAP_MKNOD);
128         int i;
129         for (i=1; i<argc; i++){
130                 const char *arg = argv[i];
131                 const char *opt = argv[i+1];
132                 if (strcmp(arg,"--secure")==0){
133                         remove = secure;
134                 }else if (strcmp(arg,"--show")==0){
135                         show = 1;
136                 }else if (strcmp(arg,"--flag")==0){
137                         if (strcmp(opt,"lock")==0){
138                                 flags |= 1;
139                         }else if (strcmp(opt,"sched")==0){
140                                 flags |= 2;
141                         }else if (strcmp(opt,"nproc")==0){
142                                 flags |= 4;
143                         }else if (strcmp(opt,"private")==0){
144                                 flags |= 8;
145                         }else if (strcmp(opt,"hideinfo")==0){
146                                 flags |= 32;
147                         }else{
148                                 fprintf (stderr,"Unknown flag %s\n",opt);
149                         }
150                         i++;
151                 }else if (arg[0] == '-' && arg[1] == '-'){
152                         static struct {
153                                 const char *option;
154                                 int bit;
155                         }tbcap[]={
156                                 // The following capabilities are normally available
157                                 // to vservers administrator, but are place for
158                                 // completeness
159                                 {"CAP_CHOWN",CAP_CHOWN},
160                                 {"CAP_DAC_OVERRIDE",CAP_DAC_OVERRIDE},
161                                 {"CAP_DAC_READ_SEARCH",CAP_DAC_READ_SEARCH},
162                                 {"CAP_FOWNER",CAP_FOWNER},
163                                 {"CAP_FSETID",CAP_FSETID},
164                                 {"CAP_KILL",CAP_KILL},
165                                 {"CAP_SETGID",CAP_SETGID},
166                                 {"CAP_SETUID",CAP_SETUID},
167                                 {"CAP_SETPCAP",CAP_SETPCAP},
168                                 {"CAP_SYS_TTY_CONFIG",CAP_SYS_TTY_CONFIG},
169                                 {"CAP_LEASE",CAP_LEASE},
170                                 {"CAP_SYS_CHROOT",CAP_SYS_CHROOT},
171
172                                 // Those capabilities are not normally available
173                                 // to vservers because they are not needed and
174                                 // may represent a security risk
175                                 {"--LINUX_IMMUTABLE",CAP_LINUX_IMMUTABLE},
176                                 {"--NET_BIND_SERVICE",CAP_NET_BIND_SERVICE},
177                                 {"--NET_BROADCAST",CAP_NET_BROADCAST},
178                                 {"--NET_ADMIN", CAP_NET_ADMIN},
179                                 {"--NET_RAW",   CAP_NET_RAW},
180                                 {"--IPC_LOCK",  CAP_IPC_LOCK},
181                                 {"--IPC_OWNER", CAP_IPC_OWNER},
182                                 {"--SYS_MODULE",CAP_SYS_MODULE},
183                                 {"--SYS_RAWIO", CAP_SYS_RAWIO},
184                                 {"--SYS_PACCT", CAP_SYS_PACCT},
185                                 {"--SYS_ADMIN", CAP_SYS_ADMIN},
186                                 {"--SYS_BOOT",  CAP_SYS_BOOT},
187                                 {"--SYS_NICE",  CAP_SYS_NICE},
188                                 {"--SYS_RESOURCE",CAP_SYS_RESOURCE},
189                                 {"--SYS_TIME",  CAP_SYS_TIME},
190                                 {"--MKNOD",             CAP_MKNOD},
191                                 {NULL,0}
192                         };
193                         int j;
194                         for (j=0; tbcap[j].option != NULL; j++){
195                                 if (strcasecmp(tbcap[j].option,arg)==0){
196                                         remove |= (1<<tbcap[j].bit);
197                                         break;
198                                 }
199                         }
200                         if (tbcap[j].option != NULL){
201                                 usage();
202                         }
203                 }else{
204                         break;
205                 }
206         }
207         if (i == argc){
208                 if (show){
209                         reducecap_show();
210                 }else{
211                         usage();
212                 }
213         }else if (argv[i][0] == '-'){
214                 usage();
215         }else{
216                 struct __user_cap_header_struct header;
217                 struct __user_cap_data_struct user;
218                 header.version = _LINUX_CAPABILITY_VERSION;
219                 header.pid = 0;
220                 if (capget(&header,&user)==-1){
221                         perror ("capget");
222                 }else{
223                         if (show){
224                                 reducecap_print (&user);
225                         }
226                         if (vc_new_s_context(-2,remove,flags)==-1){
227                                 perror ("new_s_context -2");
228                         }else{
229                                 fprintf (stderr,"Executing\n");
230                                 execvp (argv[i],argv+i);
231                                 fprintf (stderr,"Can't execute command %s\n",argv[i]);
232                         }
233                 }
234         }
235         return ret;
236 }
237