14b3177d59bcbfb28699f894826aa80386e5fe24
[util-vserver.git] / util-vserver / src / reducecap.c
1 // $Id$
2
3 // Copyright (C) 2003 Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de>
4 // based on reducecap.cc by Jacques Gelinas
5 //  
6 // This program is free software; you can redistribute it and/or modify
7 // it under the terms of the GNU General Public License as published by
8 // the Free Software Foundation; either version 2, or (at your option)
9 // any later version.
10 //  
11 // This program is distributed in the hope that it will be useful,
12 // but WITHOUT ANY WARRANTY; without even the implied warranty of
13 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14 // GNU General Public License for more details.
15 //  
16 // You should have received a copy of the GNU General Public License
17 // along with this program; if not, write to the Free Software
18 // Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
19
20 #ifdef HAVE_CONFIG_H
21 #  include <config.h>
22 #endif
23 #include "compat.h"
24
25 #include <stdio.h>
26 #include <errno.h>
27 #include <unistd.h>
28 #include <stdlib.h>
29 #include <string.h>
30
31 #include "vserver.h"
32 #include "linuxcaps.h"
33
34 extern int capget (struct __user_cap_header_struct *, struct __user_cap_data_struct *);
35 extern int capset (struct __user_cap_header_struct *, struct __user_cap_data_struct *);
36
37 static void usage()
38 {
39         fprintf (stderr,"reducecap version %s\n",VERSION);
40         fprintf (stderr,"reducecap [ options ] command argument\n");
41         exit (-1);
42 }
43
44 static void reducecap_print(struct __user_cap_data_struct *user)
45 {
46         int i;
47         printf ("%22s %9s %9s %9s\n","Capability","Effective","Permitted"
48                 ,"Inheritable");
49         for (i=0;; ++i) {
50                 char const *    text = vc_cap2text(i);
51                 int             bit  = 1<<i;
52                 if (text==0) break;
53                 
54                 printf ("%-22s %9s %9s %9s\n"
55                         ,text
56                         ,(user->effective   & bit) ? "X    " : " "
57                         ,(user->permitted   & bit) ? "X    " : " "
58                         ,(user->inheritable & bit) ? "X    " : " ");
59         }
60 }
61
62 static void reducecap_show()
63 {
64         struct __user_cap_header_struct header;
65         struct __user_cap_data_struct user;
66         header.version = _LINUX_CAPABILITY_VERSION;
67         header.pid = getpid();
68         if (capget(&header,&user)==-1){
69                 perror ("capget");
70         }else{
71                 reducecap_print (&user);
72         }
73 }
74
75
76
77 int main (int argc, char *argv[])
78 {
79         int ret = -1;
80         unsigned long remove = 0;
81         int show = 0;
82         int flags = 0;
83         unsigned long secure = (1<<CAP_LINUX_IMMUTABLE)
84                 |(1<<CAP_NET_BROADCAST)
85                 |(1<<CAP_NET_ADMIN)
86                 |(1<<CAP_NET_RAW)
87                 |(1<<CAP_IPC_LOCK)
88                 |(1<<CAP_IPC_OWNER)
89                 |(1<<CAP_SYS_MODULE)
90                 |(1<<CAP_SYS_RAWIO)
91                 |(1<<CAP_SYS_PACCT)
92                 |(1<<CAP_SYS_ADMIN)
93                 |(1<<CAP_SYS_BOOT)
94                 |(1<<CAP_SYS_NICE)
95                 |(1<<CAP_SYS_RESOURCE)
96                 |(1<<CAP_SYS_TIME)
97                 |(1<<CAP_MKNOD);
98         int i;
99         for (i=1; i<argc; i++){
100                 const char *arg = argv[i];
101                 const char *opt = argv[i+1];
102                 if (strcmp(arg,"--secure")==0){
103                         remove = secure;
104                 }else if (strcmp(arg,"--show")==0){
105                         show = 1;
106                 }else if (strcmp(arg,"--flag")==0){
107                         if (strcmp(opt,"lock")==0){
108                                 flags |= 1;
109                         }else if (strcmp(opt,"sched")==0){
110                                 flags |= 2;
111                         }else if (strcmp(opt,"nproc")==0){
112                                 flags |= 4;
113                         }else if (strcmp(opt,"private")==0){
114                                 flags |= 8;
115                         }else if (strcmp(opt,"hideinfo")==0){
116                                 flags |= 32;
117                         }else{
118                                 fprintf (stderr,"Unknown flag %s\n",opt);
119                         }
120                         i++;
121                 }else if (arg[0] == '-' && arg[1] == '-'){
122                         static struct {
123                                 const char *option;
124                                 int bit;
125                         }tbcap[]={
126                                 // The following capabilities are normally available
127                                 // to vservers administrator, but are place for
128                                 // completeness
129                                 {"CAP_CHOWN",CAP_CHOWN},
130                                 {"CAP_DAC_OVERRIDE",CAP_DAC_OVERRIDE},
131                                 {"CAP_DAC_READ_SEARCH",CAP_DAC_READ_SEARCH},
132                                 {"CAP_FOWNER",CAP_FOWNER},
133                                 {"CAP_FSETID",CAP_FSETID},
134                                 {"CAP_KILL",CAP_KILL},
135                                 {"CAP_SETGID",CAP_SETGID},
136                                 {"CAP_SETUID",CAP_SETUID},
137                                 {"CAP_SETPCAP",CAP_SETPCAP},
138                                 {"CAP_SYS_TTY_CONFIG",CAP_SYS_TTY_CONFIG},
139                                 {"CAP_LEASE",CAP_LEASE},
140                                 {"CAP_SYS_CHROOT",CAP_SYS_CHROOT},
141
142                                 // Those capabilities are not normally available
143                                 // to vservers because they are not needed and
144                                 // may represent a security risk
145                                 {"--LINUX_IMMUTABLE",CAP_LINUX_IMMUTABLE},
146                                 {"--NET_BIND_SERVICE",CAP_NET_BIND_SERVICE},
147                                 {"--NET_BROADCAST",CAP_NET_BROADCAST},
148                                 {"--NET_ADMIN", CAP_NET_ADMIN},
149                                 {"--NET_RAW",   CAP_NET_RAW},
150                                 {"--IPC_LOCK",  CAP_IPC_LOCK},
151                                 {"--IPC_OWNER", CAP_IPC_OWNER},
152                                 {"--SYS_MODULE",CAP_SYS_MODULE},
153                                 {"--SYS_RAWIO", CAP_SYS_RAWIO},
154                                 {"--SYS_PACCT", CAP_SYS_PACCT},
155                                 {"--SYS_ADMIN", CAP_SYS_ADMIN},
156                                 {"--SYS_BOOT",  CAP_SYS_BOOT},
157                                 {"--SYS_NICE",  CAP_SYS_NICE},
158                                 {"--SYS_RESOURCE",CAP_SYS_RESOURCE},
159                                 {"--SYS_TIME",  CAP_SYS_TIME},
160                                 {"--MKNOD",             CAP_MKNOD},
161                                 {NULL,0}
162                         };
163                         int j;
164                         for (j=0; tbcap[j].option != NULL; j++){
165                                 if (strcasecmp(tbcap[j].option,arg)==0){
166                                         remove |= (1<<tbcap[j].bit);
167                                         break;
168                                 }
169                         }
170                         if (tbcap[j].option != NULL){
171                                 usage();
172                         }
173                 }else{
174                         break;
175                 }
176         }
177         if (i == argc){
178                 if (show){
179                         reducecap_show();
180                 }else{
181                         usage();
182                 }
183         }else if (argv[i][0] == '-'){
184                 usage();
185         }else{
186                 struct __user_cap_header_struct header;
187                 struct __user_cap_data_struct user;
188                 header.version = _LINUX_CAPABILITY_VERSION;
189                 header.pid = 0;
190                 if (capget(&header,&user)==-1){
191                         perror ("capget");
192                 }else{
193                         if (show){
194                                 reducecap_print (&user);
195                         }
196                         if (vc_new_s_context(-2,remove,flags)==-1){
197                                 perror ("new_s_context -2");
198                         }else{
199                                 fprintf (stderr,"Executing\n");
200                                 execvp (argv[i],argv+i);
201                                 fprintf (stderr,"Can't execute command %s\n",argv[i]);
202                         }
203                 }
204         }
205         return ret;
206 }
207