aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2024-04-05Tidy up some of the automated formatting.HEADreviewmasterAndrew G. Morgan3-41/+69
doc/mkmd.sh also has some dependencies on the format of the man pages, so make that work again. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2024-04-05doc: document the use of `*` to refer to all usersCarlos Rodriguez-Fernandez1-1/+1
Signed-off-by: Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2024-04-03doc: document pam_cap and its confCarlos Rodriguez-Fernandez3-3/+125
Signed-off-by: Carlos Rodriguez-Fernandez <carlosrodrifernandez@gmail.com> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2024-02-18Reformat doc text for web.goAndrew G. Morgan1-6/+6
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2024-01-29getpcaps: fix program name in help messageJakub Wilk1-1/+1
Signed-off-by: Jakub Wilk <jwilk@jwilk.net> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2024-01-12Fix reference formatting in the captree man page.Jakub Wilk1-1/+1
Signed-off-by: Jakub Wilk <jwilk@jwilk.net> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-12-22Stop using _pam_overwrite() in pam_cap.c.Andrew G. Morgan1-2/+2
It looks like the Linux-PAM folk have deprecated this macro. Compiler optimization is hard to account for: apparently this explicit deletion is no longer guaranteed to work. This function was marked deprecated in v1.5.3 of Linux-PAM. I've replaced its use with memset(). I'm not convinced that that will be honored either, but remain hopeful and prefer to leave the code explicit in its intent without a deprecation warning messing up the build log. Should some compiler optimize it away and it leads to an exploit of some sort, it can be revealed as a compilation bug. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-08-13Restore c89 compaitbility for C source files.Andrew G. Morgan1-3/+3
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-06-24Add a check for a capabability of all spaces.Andrew G. Morgan1-0/+12
Address user report of confusing behavior by adding a check to setcap for a "<space...>" capability not meaning "-r". Another suggestion from https://bugzilla.kernel.org/show_bug.cgi?id=217592 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-06-24Make it harder to set invalid capabilities on files.Andrew G. Morgan3-10/+55
This change introduces the setcap -f argument to allow setting of nonsense capabilities on files. But the default is to fail when attempting to set such invalid capabilities. This commit addresses: https://bugzilla.kernel.org/show_bug.cgi?id=217592 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-05-24Tidy up the overview example for the "cap" package.Andrew G. Morgan1-1/+2
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-05-14Up the release version to 2.69v1.2.69psx/v1.2.69libcap-korg-2.69libcap-2.69cap/v1.2.69Andrew G. Morgan11-13/+13
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-05-09Ignore the content of a capability.conf file if it is world-writable.Andrew G. Morgan4-5/+44
Other than the case of /dev/null, there is no situation in which pam_cap.so should act on world writable config files. There are legitimate local administration choices for the file being owned by non-root users, and similarly writable by a group of trusted users. So, we do not require any specific ownership for the file and do not check for writable access based on owner of group membership. Credit for finding this bug in pam_cap.so goes to X41 D-Sec GmbH (https://x41-dsec.de/) who performed a security audit of the libcap source code in April of 2023. The audit was sponsored by the Open Source Technology Improvement Fund (https://ostif.org/). Audit ref: LCAP-CR-23-101 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-05-09There was a small memory leak in pam_cap.so when libpam returned an error.Andrew G. Morgan1-1/+6
The function pam_set_data() takes ownership of a memory pointer if the call succeeds, but does not take that ownership if the function fails. Previously, the failure caused no deferred capability setting and a return code PAM_IGNORE. It continues to do that in this case, but no longer leaks the allocated iab memory. This bug was introduced with deferred IAB capability setting support in libcap-2.58. Credit for finding this bug in pam_cap.so goes to X41 D-Sec GmbH (https://x41-dsec.de/) who performed a security audit of the libcap source code in April of 2023. The audit was sponsored by the Open Source Technology Improvement Fund (https://ostif.org/). Audit ref: LCAP-CR-23-100 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-05-09Large strings can confuse libcap's internal strdup code.Andrew G. Morgan1-5/+7
Avoid something subtle with really long strings: 1073741823 should be enough for anybody. This is an improved fix over something attempted in libcap-2.55 to address some static analysis findings. Reviewing the library, cap_proc_root() and cap_launcher_set_chroot() are the only two calls where the library is potentially exposed to a user controlled string input. Credit for finding this bug in libcap goes to Richard Weinberger of X41 D-Sec GmbH (https://x41-dsec.de/) who performed a security audit of the libcap source code in April of 2023. The audit was sponsored by the Open Source Technology Improvement Fund (https://ostif.org/). Audit ref: LCAP-CR-23-02 (CVE-2023-2603) Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-05-09Correct the check of pthread_create()'s return value.Andrew G. Morgan1-1/+1
This function returns a positive number (errno) on error, so the code wasn't previously freeing some memory in this situation. Discussion: https://stackoverflow.com/a/3581020/14760867 Credit for finding this bug in libpsx goes to David Gstir of X41 D-Sec GmbH (https://x41-dsec.de/) who performed a security audit of the libcap source code in April of 2023. The audit was sponsored by the Open Source Technology Improvement Fund (https://ostif.org/). Audit ref: LCAP-CR-23-01 (CVE-2023-2602) Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-04-22Partially revive fully static binaries.Andrew G. Morgan2-2/+7
It looks like I broke the kdebug target build when I dropped fully static building of capsh and friends. Discovered this, looking at answering: https://unix.stackexchange.com/questions/741532/launch-process-with-limited-capabilities-on-minimal-busybox-based-system Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-04-10Improve style in man page function prototypesEmanuele Torre2-7/+7
Use type *id everywhere instead of using type * id and type* id in some places. Also remove superflous spaces after commas, and closing parentheses. While doing this, I also fixed a C syntax mistake in an example in cap_launch.3 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-03-25Up the release version to 2.68v1.2.68psx/v1.2.68libcap-korg-2.68libcap-2.68cap/v1.2.68Andrew G. Morgan11-13/+13
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-03-25Undo hiding the wrapped function call in libpsx.Andrew G. Morgan1-1/+0
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-03-19Tidy up some text explaining cap.NamedCaps.Andrew G. Morgan2-4/+4
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-03-18Some formatting fixes for the libpsx man page.Andrew G. Morgan1-14/+20
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-03-11Replace the README with a README.mdAndrew G. Morgan3-18/+30
Also include the `go mod tidy` detail. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-02-19Recognize the new man page links.Andrew G. Morgan1-0/+2
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-02-19Update documentation for all API functions.Andrew G. Morgan11-30/+82
There were a few straggler API functions in libcap and libpsx. Also some functions that should be hidden from references outside the library. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-02-11Drop vendor directory and clean up extra gcc...sh fileAndrew G. Morgan3-141/+0
These three files were left over, they should have been removed in the last commit. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-02-11Simplify and refactor the bug215510 code.Andrew G. Morgan14-51/+309
This code is investigating the issue: https://bugzilla.kernel.org/show_bug.cgi?id=216610 This present commit extends x86_64 (aka amd64) support to 32-bit arm build support. It is now possible cross compile the program for the Raspberry Pi. To do this, the code needs 'docker' to work. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-02-09Make the compare-cap binary clean up after itself.Andrew G. Morgan2-5/+8
When run via sudo, compare-cap exits with some file capabilities left on its binary file. This is a test binary, so that's not a big problem, however, it does mean that a 2nd run of the program is started with, potentially, a different initial state. This commit fixes that exit condition and addresses: https://bugzilla.kernel.org/show_bug.cgi?id=217018 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-02-08Be more strict about what symbols are externally visible.Andrew G. Morgan3-2/+7
Increase the enforcement of the documented libcap API by marking internal library utility functions as "hidden". This also goes for the .so executable entry points. This addresses this bug: https://bugzilla.kernel.org/show_bug.cgi?id=217014 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-02-06Sigh. Fix some copy-pasta errors with psx_test.go changes.Andrew G. Morgan1-3/+3
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-02-06Add some more explicit testing to the psx_test.go code.Andrew G. Morgan1-1/+58
While we test this in many other places, we didn't test this explicitly in the psx.go local testing before. Now we do. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-02-06Provide a method to import preamble and postscript for md man pagesAndrew G. Morgan1-0/+16
If you have local files: .../libcap/doc/local-md.preamble .../libcap/doc/local-md.postscript when you run .../libcap/doc/mkmd.sh these two files will be inlined into the generated index.md file. This addresses: https://bugzilla.kernel.org/show_bug.cgi?id=217007 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-02-06Drop an unnecessary use of ", _" from captree.goAndrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-02-02Up the release version to 2.67v1.2.67psx/v1.2.67libcap-korg-2.67libcap-2.67cap/v1.2.67Andrew G. Morgan10-12/+12
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2023-02-02Resolve a couple of compiler warnings.Andrew G. Morgan2-2/+2
Explicitly add (void) as argument lists for two function definitions: cap_reset_ambient(void) _libcap_initialize(void) Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-10-30Clean up some of the markdown text.Andrew G. Morgan2-22/+22
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-10-29Minor clean ups of the contrib/bug216610 code/docsAndrew G. Morgan2-5/+8
I generated mirror on github to conveniently see the .md docs and found a few typos. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-10-29Add support for optimized C compilation to .syso objects.Andrew G. Morgan3-26/+104
It took me a while to figure out why optimized C compilation seemed to generate miscomputation of the Fibonacci number sequence. It appears to be an unresolved issue with Go's internal linking which is discussed here: https://github.com/golang/go/issues/24321 For a compute kernel, it seems important to be able to accommodate compiler optimization. This adds some refinement for the strategy I'm exploring to address: https://bugzilla.kernel.org/show_bug.cgi?id=216610 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-10-23Add an example of combining Go, C code and "psx" without cgo.Andrew G. Morgan8-0/+258
This example was developed while investigating the issues discussed in: https://bugzilla.kernel.org/show_bug.cgi?id=216610 At this time, it is not possible to build CGO_ENABLED=1 and include the "psx" package without using its "cgo"-tagged build variant. This example provides a worked example of doing the opposite: link a CGO_ENABLED=0 binary with "psx", including some compiled C code. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-10-19Reviewed license information and adde SPDX ids.Andrew G. Morgan5-1/+9
Günther Noack reported some issues with automated dependency checking in https://bugzilla.kernel.org/show_bug.cgi?id=216609 Perhaps these additional lines will help assist those things. I did find a typo in pam_cap/execable.c so I've fixed that. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-10-16Reviewed man pages, adding overlooked references.Andrew G. Morgan11-29/+150
This started out as addressing this bug: https://bugzilla.kernel.org/show_bug.cgi?id=216585 But I then made crosslink.sh to figure out what I had missed, and fixed those bits too. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-10-15Modify DYNAMIC=no linking to only refer to libcap.aAndrew G. Morgan1-5/+7
There is a longstanding WONT_FIX bug: https://sourceware.org/bugzilla/show_bug.cgi?id=12491 that has been causing capsh, when linked fully statically, to segfault. So, for non-dynamic linking of capsh etc utilities only link statically to libcap. This way, in tree builds can be guaranteed to get to execute with in tree API changes. For normal installations, DYNAMIC=yes works as before. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-10-09Add some exploit demonstration code to capso.soAndrew G. Morgan2-7/+78
This exploit code requires a make variable to activate, but is used in the companion article discussing this code to compare and contrast setuid-root to file capable privilege. Tl;dr don't use setuid-root for shared libraries in this way! Follow along here: https://sites.google.com/site/fullycapable/capable-shared-objects Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-10-04Address bad-whatis-entry issue noticed by Debian build testsAndrew G. Morgan2-0/+10
Details: https://www.mit.edu/afs.new/sipb/project/debathena/lintian/www/tags/manpage-has-bad-whatis-entry.html Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-09-29Use POSIX `grep`David Seifert4-4/+4
* GNU grep 3.8 considers `egrep` and `fgrep` obsolescent and throws warnings: ./mkcapshdoc.sh > capshdoc.c.cf fgrep: warning: fgrep is obsolescent; using /bin/grep -F fgrep: warning: fgrep is obsolescent; using /bin/grep -F fgrep: warning: fgrep is obsolescent; using /bin/grep -F fgrep: warning: fgrep is obsolescent; using /bin/grep -F [...] https://lists.gnu.org/archive/html/info-gnu/2022-09/msg00001.html Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-09-24Up the release version to 2.66v1.2.66psx/v1.2.66libcap-korg-2.66libcap-2.66cap/v1.2.66Andrew G. Morgan10-12/+12
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-09-22Fix typos in the cap_from_text.3 man page.Andrew G. Morgan1-4/+4
This addresses this bug reported by Paulo Andrade (thanks!): https://bugzilla.kernel.org/show_bug.cgi?id=216514 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-09-22Add captrace to .gitignore fileAndrew G. Morgan1-0/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-09-18Add an example of using BPF kprobing to trace capability use.Andrew G. Morgan3-2/+240
$ make $ sudo go/captrace your-program will attempt to explore what capabilities are needed to run your program by observing when cap_capable() inside the kernel is associated with your-program. Other ways to invoke this are $ sudo go/captrace --pid=<pid> $ sudo go/captrace The last of these traces everything running on a system. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-09-04Clean up getpcaps code.Andrew G. Morgan1-51/+52
Address some corner cases and trim down the size of the code a bit. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-09-04getpcaps: catch PID parsing errors.Jakub Wilk1-1/+18
Signed-off-by: Jakub Wilk <jwilk@jwilk.net> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-08-05Fix an issue with bash displaying an error.Andrew G. Morgan2-14/+41
Also down size the default capabilities needed by the 'sucap' su program. This is aimed at addressing: https://bugzilla.kernel.org/show_bug.cgi?id=215926 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-07-22Some more simplifications for buildingAndrew G. Morgan2-1/+6
I'm not 100% sure this is needed, but I'm not yet convinced 'make distclean && make -j48 test' works reliably, but I find this easier to reason about. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-07-21Fix for "make clean ; make -j48 test"Andrew G. Morgan1-2/+2
Missed a vendor dependency for the ok.go file. More recent go releases seem more picky about module or vendoring being used, and for the in-tree builds we consistently use vendoring. So make sure the vendoring directory set up has completed before trying to build ok.go. The failure was reported by Tomasz Kłoczko. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-07-17Up the release version to 2.65v1.2.65psx/v1.2.65libcap-korg-2.65libcap-2.65cap/v1.2.65Andrew G. Morgan10-12/+12
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-07-09Include more signatures in pgp.keys.asc.Andrew G. Morgan1-90/+161
These updates should also be available on keyservers. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-05-17Close out this comment in the go/MakefileAndrew G. Morgan1-1/+4
The deadlock issue is fixed in go1.18. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-04-30Prevent 'capsh --user=xxx --' from generating a bash error.Andrew G. Morgan2-1/+24
This change adds support to capsh for the --noenv argument, which will restore pre-libcap-2.65 behavior to capsh. The change we're making here, however, is that capsh will now set the USER and HOME environment variables when the command line contains --user=xxx. The issue this addresses is described here: https://bugzilla.kernel.org/show_bug.cgi?id=215926 This has been annoying me for long enough, and I want to clean up the article: https://sites.google.com/site/fullycapable/inheriting-privilege to not pepper "--norc" in distracting places. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-04-28Improve documentation for cap_get_pid and cap_reset_ambient.Andrew G. Morgan1-18/+35
- cap_get_pid() add detail about the function argument and return value when used across namespaces. Thanks to nemonemo for reporting: https://bugzilla.kernel.org/show_bug.cgi?id=215812 - cap_reset_ambient() had some factually incorrect content. Thanks to Tinker One for reporting: https://bugzilla.kernel.org/show_bug.cgi?id=215910 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-04-17Fix syntax error in DEBUG protected setcap.c code.Andrew G. Morgan1-1/+1
Bug reported with fix from yixiangzhike. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-04-11More useful captree usage string and man page.Andrew G. Morgan2-7/+17
Include more detail about command line expectations and exit status values. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-04-10Up the release version to 2.64v1.2.64psx/v1.2.64libcap-korg-2.64libcap-2.64cap/v1.2.64Andrew G. Morgan9-11/+11
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-04-10Avoid a deadlock in forked psx thread exit.Andrew G. Morgan1-3/+10
go/captree was seeing lots of libcap_psx_test processes hanging around. It turns out that the newly added _psx_cleanup() function was deadlocking because inside a forked processes the psx_tracker.state was _PSX_INFORK and never _PSX_IDLE. This completes the fix for: https://bugzilla.kernel.org/show_bug.cgi?id=215551 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-04-10Include LIBCAP_{MAJOR,MINOR} #define's in sys/capability.hAndrew G. Morgan2-0/+9
It looks like various distributions are fairly far behind HEAD for their version of libcap. This way folk can work around a lack of features in their code. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-04-09Clarify how the cap_get_pid() argument is interpreted.Andrew G. Morgan1-1/+6
Addresses: https://bugzilla.kernel.org/show_bug.cgi?id=215812 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-03-29Fix prctl return code/errno handling in libcap.Andrew G. Morgan2-26/+37
Bug reported by Anderson Toshiyuki Sasaki: https://bugzilla.kernel.org/show_bug.cgi?id=215772 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-02-13Be explicit about CGO_ENABLED=1 for compare-cap build.Andrew G. Morgan1-2/+2
It looks like go1.18 is going to default to CGO_ENABLED=0, so force CGO_ENABLED=1 when building this cap-libcap comparison program. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=215603 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-02-05psx: free allocated memory at exit.Andrew G. Morgan1-1/+43
Kalen Hall reported that Valgrind detected a memory leak associated with a multi-threaded program linked against libcap and libpsx. https://bugzilla.kernel.org/show_bug.cgi?id=215551 I've been unable to validate this myself with valgrind (likely holding it wrong), but did explore psx for allocated memory and via fprintf's convinced myself that this change should pair all calloc()s with a corresponding free(). Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-01-23Up the release version to 2.63v1.2.63psx/v1.2.63libcap-korg-2.63libcap-2.63cap/v1.2.63Andrew G. Morgan8-10/+10
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-01-23Trim includes.Andrew G. Morgan6-9/+6
I've upgraded one of my systems to Fedora 35 and I found trimming the headers in this way made the three compilations of libcap, used by `make distcheck`, work with standard Fedora 35 compiler packages. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-01-23Add a test case for a deadlock.Andrew G. Morgan3-3/+44
The CGO_ENABLED=0 failure mode is discussed in: https://github.com/golang/go/issues/50113 At the present time, this only passes when the psx package is compiled CGO_ENABLED=1. The problem being that a blocking read cannot be interrupted by the CGO_ENABLED=0 build of package "psx". It does not deadlock when compiled CGO_ENABLED=1 because the psx signal wakes the reading thread up back into user space. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2022-01-19Reset the value of errno for main()Andrew G. Morgan2-5/+12
Since libcap does some error testing with a pre-main() constructor, reset errno to zero as that constructor returns. Problem reported by Yang Xu. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-12-13Fix argument crash dump order in psx text dumper.Andrew G. Morgan1-6/+6
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-12-12Make cgo psx_syscall variant crash like runtime.AllThreadsSyscallAndrew G. Morgan9-19/+162
When a syscall that yields different return values is called from the Go psx.Syscall*() API, we want to mirror the behavior of the native golang runtime.AllThreadsSyscall() function. The previous inconsistency was pointed out by Lorenz Bauer in: https://bugzilla.kernel.org/show_bug.cgi?id=215283#c8 [I decided to defer this change until 2.63, and not include this in the bug-fix for 215283, on the grounds it is a slight incompatibility in runtime behavior, and wanted to give folk an opportunity to plan for it. This new behavior enforcement will crash an unprepared go program.] Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-12-11Up the release version to 2.62v1.2.62psx/v1.2.62libcap-korg-2.62libcap-2.62cap/v1.2.62Andrew G. Morgan8-10/+10
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-12-11Clean up cap package documentation for Launch.Andrew G. Morgan1-5/+8
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-12-11Complete launch thread exit sequence.Andrew G. Morgan1-20/+29
This should complete the fix for: https://bugzilla.kernel.org/show_bug.cgi?id=215283 Simplify the code, and add a test that the kernel has confirmed that the thread is no longer running. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-12-10Take more care post launchAndrew G. Morgan4-6/+72
Lorenz Bauer found a race condition in the cap.Launcher teardown process and reported it here: https://bugzilla.kernel.org/show_bug.cgi?id=215283 This seems to significantly improve the situation. I'm going to study the test case some more, but this is definitely part of the solution. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-12-04Drop perl from the build requirements.Andrew G. Morgan5-11/+32
David Seifert at Gentoo made a request to not require perl for the libcap build since their distribution wants to build it prior to building perl and so requiring it requires they maintain some extra patches. We previously introduced the need for perl in response to some apparent incompatibilities between various versions of sed: https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=9494a1fab59ac0b6e4f0bfc536fa482c6d6490b6 However, it has been 13 years since that time so we're optimistic those problems are no longer present for anyone and we've also added a make variable abstraction in case some builder wants to override their system default 'sed' as make BUILD_SED=... etc. We've also done something similar with make uses of grep, egrep and fgrep. Finally, for make variable naming consistency, we've replaced use of BUILD_GPERF with USE_GPERF. Since folk may be using BUILD_GPERF in their package building scripts, we error out if it is set. The expectation is that people will update their package defs. (Eventually, we plan to reuse BUILD_GPERF as an alias for 'gperf'.) Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-28Fix `-Wformat` on 32-bit platformsDavid Seifert1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-21Include link for cap_max_bits.3 man page.Andrew G. Morgan2-5/+8
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-21Recognize default secbits of 0 as "HYBRID" mode.Andrew G. Morgan5-3/+21
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-20Up the release version to 2.61v1.2.61psx/v1.2.61libcap-korg-2.61libcap-2.61cap/v1.2.61Andrew G. Morgan8-10/+10
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-20Clean up libpsx.so execable mode.Andrew G. Morgan2-2/+17
The previous commit crossed the beams on libpsx.so and libcap.so executable build. This commit decouples them. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-20Add some more info to the libcap.so as an executable.Andrew G. Morgan2-0/+49
Mostly cause we can, but this gives a little more diagnostic value to the libcap.so executable mode of operation. usage: libcap.so [--help|--usage|--summary] Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-20Add some information about cap_max_bits().Andrew G. Morgan3-1/+17
This function has been defined for a while (since libcap-2.30), but I just found it wasn't documented. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-17Prune the the.Andrew G. Morgan3-4/+4
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-14Force libcap.so to initialize itself when run directly.Andrew G. Morgan4-3/+22
Not sure where this will go, but libcap.so uses _libcap_initialize() to set itself up at start up. So, run it when invoking libcap.so directly as a binary. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-14Work around musl not hard-coding the ABI for Linux x86_64.Andrew G. Morgan1-4/+8
There seems to be a subtle difference between glibc and musl over whether or not a runnable *.so needs to start out with its stack aligned to 16 bytes or not. Since Linux ABIs for x86 (both 32 and 64 bit varieties) require 16 byte alignment, just force it on both these architectures. This addresses: https://bugzilla.kernel.org/show_bug.cgi?id=215009 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-13Work around a __i386__ compilation issue for runnable .so files.Andrew G. Morgan1-14/+20
This was reported by Sam James and debugged with respect to: https://bugs.gentoo.org/show_bug.cgi?id=820071 Modern versions of glibc employ SSE instructions that require the stack to be aligned to 16 bytes in order to execute movaps and friends to stack stored memory. The ABI for x86_64 requires this alignment so we'd not seen this issue before being cc:d into the bug. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-10Pick the correct topdir in our sucap example.Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-09Include some helpful debugging for capso.soAndrew G. Morgan2-1/+16
This makes explaining how the program works more straightforward. That is: make CAPSO_DEBUG=-DCAPSO_DEBUG clean all builds a version that prints out some helpful info and pauses so the user can observe the capability state of the process tree at different stages of execution. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-07Use calloc'd memory for unix domain socket exchange.Andrew G. Morgan1-24/+43
This seems more stable for passing file descriptor from privileged child to unprivileged parent. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-07An example of a shared library object with its own file capability.Andrew G. Morgan5-0/+353
I've been exploring the idea of how to create limited use privileged binaries that can be linked into otherwise unprivileged binaries. This is a worked example of the bootstrapping process for a webserver. I intend to provide a more complete writeup of what is going on with this example here: https://sites.google.com/site/fullycapable/capable-shared-objects For this present example to work you have to be using a libcap that includes cap_launch support (ie., libcap 2.33+, but this code will be included with libcap-2.61 and might inadvertently actually require something that new to work robustly). This code appears to be very fragile at present. It works on my Chromebook's linux container, but not under Fedora 34 - segfaulting. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-06capsh: better error handling for integer parsing.Andrew G. Morgan1-9/+40
Bug reported by meitingli: https://bugzilla.kernel.org/show_bug.cgi?id=214911 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-11-06setcap: clean up error handling of the ns rootid argument.Andrew G. Morgan1-8/+33
Bug reported by Artem S. Tashkinov: https://bugzilla.kernel.org/show_bug.cgi?id=214909 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-10-22Up the release version to 2.60v1.2.60psx/v1.2.60libcap-korg-2.60libcap-2.60cap/v1.2.60Andrew G. Morgan8-10/+10
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-10-22Add --quiet and cap_launch() support to capsh.Andrew G. Morgan2-17/+87
The flag --quiet causes capsh to suppress its startup check that the linked libcap has support for all of the named capabilities of the hosting kernel. The cap_launch() support is via "-+" and "=+" arguments. These use cap_launch() to fork() before exec*()ing the corresponding command but are otherwise equivalent to "--" and "==" respectively. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-10-22Unify the cap package tests for good *Set or *IAB types.Andrew G. Morgan5-33/+58
We had somewhat inconsistent checks before, so this should cut down on corner cases to worry about. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-10-22Concurrency fixes for *cap.Set atomicity.Andrew G. Morgan4-36/+58
Previously, the atomicity was not uniformly enforced. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-10-22Bugfix for (*IAB).Fill() and improve atomicity of API.Andrew G. Morgan3-15/+105
Improve atomicity of Launcher and IAB use within the cap package. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-10-22Make cap_launcher_t operations atomic.Andrew G. Morgan4-21/+72
Modify the cap_launch() behavior when chroot is set. Now, the launcher code will force the post chroot() environment to chdir("/"). Modify the API for many of the cap_launch_*() functions that previously were void, to returning int (0=OK, -1=see errno). I'm confident that this should be code backwardly compatible, since the return values are new and prior code would have been assuming success. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-10-22Add a cap_iab_dup() function and make IAB access atomic.Andrew G. Morgan10-16/+97
Embed mutex locked operation into the IAB API. The idea being that while libcap operates on an IAB tuple, it cannot be operated on by a thread running in parallel. This makes IAB access thread safe (but not reentrant). The only potential API behavioral change is that the IAB tuple associated with a cap_launcher_t is now locked for the duration of its association with that launcher. This prevents a race condition with launching and another thread changing that IAB tuple. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-10-22Make cap_t operations thread safe.Andrew G. Morgan7-57/+152
If two threads operate on the same cap_t value, ensure that the operations occur atomically. (Not, however, reentrantly.) Also added some sanity checking to cap_set_nsowner() and cap_get_nsowner(). Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-10-01Implement cap_fill_flag() and cap.FillFlag() APIs.Andrew G. Morgan8-15/+68
This API avoids a complex use case that requires substantially more code outside of libcap. Signed-off-by: Andrew G. Morgan <agm@google.com> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-10-01Lower the start up memory allocation overhead.Andrew G. Morgan4-7/+16
In the vast majority of cases, code will not need to override the "/proc" root directory, so treat NULL as equivalent to "/proc". Signed-off-by: Andrew G. Morgan <agm@google.com> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-29Fix miscellaneous build and lint warnings.Andrew G. Morgan11-439/+459
Addresses the issues listed here: https://bugzilla.kernel.org/show_bug.cgi?id=214579 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-28Make capshdoc.h stand alone compile friendly.Andrew G. Morgan2-2/+6
Signed-off-by: Andrew G. Morgan <agm@google.com> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-26Up the release version to 2.59v1.2.59psx/v1.2.59libcap-korg-2.59libcap-2.59cap/v1.2.59Andrew G. Morgan8-10/+10
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-24Fix to 'make clean sudotest' reliablyAndrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-24Recognize that NULL is an invalid cap_t and cap_iab_t.Andrew G. Morgan5-13/+33
This was a regresssion introduced in libcap-2.55. Fixed in libcap-2.59. Added a cap_launch NULL test too. Comparing against NULL would cause a SIGSEGV against these library revisions. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-23Update example to avoid reference to deprecated Compare function.Andrew G. Morgan1-1/+1
In 2.54 (*Set).Compare() was deprecated in favor of (*Set).Cf(), so update the top level comment to reflect the preferred API. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-22Spelling fix.Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-17More compliant cap.Differs documentation.Andrew G. Morgan1-3/+17
Deprecation has a stylized comment format as per go.dev. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-17Up the release version to 2.58v1.2.58psx/v1.2.58libcap-korg-2.58libcap-2.58cap/v1.2.58Andrew G. Morgan8-10/+10
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-14Fix typo in capsh.Andrew G. Morgan1-1/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-14Add some debugging info for the pam_cap.so deferred callback.Andrew G. Morgan1-0/+18
As with the other D(()) entries in the pam_cap.so module, this is enabled if the /* #define PAM_DEBUG */ comment is uncommented at the top of the pam_cap.so file. I tried this on a sample app and it didn't actually follow the documentation: http://www.linux-pam.org/Linux-PAM-html/adg-interface-by-app-expected.html#adg-pam_end where no pam_end() call was made to terminate the fork()ed copy of the pamh value. That app needs to be fixed. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-14Another attempt at supporting Ambient vector setting from pam_cap.so.Andrew G. Morgan3-60/+55
While the session idea worked with contrib/sucap/su.c, it failed on more traditional PAM apps. For a second (likely last) attempt to find a path, I've deleted the session support and now attempt to do the setting via a PAM data item cleanup() callback. In the contrib/sucap/su.c code, evolved from the original SimplePAMApps 'su', there is a pam_end(pamh, PAM_SUCCESS | PAM_DATA_SILENT) from within the fork()d launcher code, so I hope this convention is standard for all the PAM apps that came after. The suggested config for this module for an app, that wants to support the Ambient vector, is thus now: #%PAM-1.0 auth required pam_cap.so keepcaps defer auth required pam_unix.so account required pam_unix.so password required pam_unix.so session required pam_unix.so This is all part of an effort to address: https://bugzilla.kernel.org/show_bug.cgi?id=214377 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-14Not sure why I didn't include this line before!Andrew G. Morgan1-0/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-13Simplify the contric/sucap/su structure.Andrew G. Morgan2-77/+80
Also include the aggressive default CFLAGS, and fix the many many issues it uncovered. (Honestly, it was a wonder it worked at all before.) Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-13Add PAM "session" support to pam_cap.so.Andrew G. Morgan3-19/+79
This is an attempt to address: https://bugzilla.kernel.org/show_bug.cgi?id=214377 The basic structure is you configure PAM with a config like this: #%PAM-1.0 auth required pam_cap.so use_session keepcaps auth required pam_unix.so account required pam_unix.so password required pam_unix.so session required pam_unix.so session optional pam_cap.so Here the "auth" part prepares the application with "keepcaps", and the "use_session" instructs the module to apply any IAB tuple for the user at session open time and not during the setcred (auth) flow. This has been tested against the contrib/sucap implementation of su. The "use_session" support should work with more standard PAM enabled apps too, but I'll wait for some positive feedback (see the bug) before declaring it stable. FWIW the contrib/sucap/su app also supports this config for Ambient vector setting (without a "session" invocation of pam_cap.so): #%PAM-1.0 auth required pam_cap.so auth required pam_unix.so account required pam_unix.so password required pam_unix.so session required pam_unix.so but that is because the sucap/su app is more tightly integrated with libcap than the standard PAM apps. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-12Free _cap_proc_dir on exit.Andrew G. Morgan1-0/+13
Credit to yan12125 for finding this bug: https://bugzilla.kernel.org/show_bug.cgi?id=214373 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-12kdebug shouldn't require sudotest to build uns_test binary.Andrew G. Morgan1-1/+2
Part of the reason for the QEMU kernel test is to fully test the library against kernels without requiring sudo. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-11Recover the kdebug make rules.Andrew G. Morgan1-1/+1
These were broken as a result of delaying building the test and sudotest binaries until they were actually needed. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-11Add in something the builder can override to augment the GO buildsAndrew G. Morgan2-12/+13
I've been looking at reasons packagers are not building the Go binaries and found this with respect to RPMs: https://github.com/rpm-software-management/rpm/issues/367 There has been no easy way to inject the otherwise unneeded workaround: -ldflags=-linkmode=external for building (which, strangely, generates some sort of warning and gratuitously links glibc to an otherwise static build), but seems to work. Until RPM supports Go's native '.note.go.buildid', and RPM requires '.note.gnu.build-id' on binaries, I guess this can work around it: GO_BUILD_FLAGS='-ldflags=-linkmode=external' Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-10Update pam_cap .gitignore fileAndrew G. Morgan1-0/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-10Another missing dependency for make -j13Andrew G. Morgan1-1/+6
One more missing dependency for pam_cap.so building. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-10More standard deprecation comment for cap.Compare and cap.IABInitAndrew G. Morgan2-6/+39
Based on what I see on go.dev, there seems to be some preferred comment style for deprecating a function. Use it to help spread the word. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-09Up the release version to 2.57v1.2.57psx/v1.2.57libcap-korg-2.57libcap-2.57cap/v1.2.57Andrew G. Morgan8-10/+10
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-07Implement --strict capsh argument.Andrew G. Morgan3-95/+109
Up to this point, capsh hides some complexity concerning raising the CAP_SETPCAP in order to raise inheritable and drop bounding set values. This made it harder to explain some aspects of inheritance, and I ran into that detail writing this: https://sites.google.com/site/fullycapable/why-didnt-that-work#h.z7rwbcazhr4r Refactored capsh.c to clean up some buggy code, and also fix some documentation, including reference to the --strict argument. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-07Be more systematic about POSIX.1e value group namesAndrew G. Morgan6-78/+94
cap.Set's have Flag component Values cap.IAB's have Vector component Values Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-05Fixed parallel make issuesAndrew G. Morgan3-3/+3
Tried make -j12 and these fixes were needed. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-05Treat ENOTSUP as an expected error for getcap.Andrew G. Morgan1-1/+1
Things like /proc/* files don't support capabilities on them and if getcap looks at them it generates a lot of errors. Treat it as equivalent to there being no capability on the file. This addresses https://bugzilla.kernel.org/show_bug.cgi?id=214317 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-05Add --mode query support to capshAndrew G. Morgan2-27/+41
This addresses the feature request: https://bugzilla.kernel.org/show_bug.cgi?id=214319 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-04Refactor top level Makefile to reduce redundant buildingAndrew G. Morgan6-28/+21
Make build a bit quicker for folk that don't want to run tests. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-04Don't build the tests/binaries until we want to run themAndrew G. Morgan1-5/+3
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-04Build system fixesDavid Seifert1-2/+3
Summary: - Always keep $(WARNINGS) when overriding CFLAGS Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-02Up the release version to 2.56v1.2.56psx/v1.2.56libcap-korg-2.56libcap-2.56cap/v1.2.56Andrew G. Morgan8-10/+10
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-02Document latest option for captree in its man page.Andrew G. Morgan1-1/+8
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-02Make captree use --color on any terminal by default.Andrew G. Morgan1-13/+28
Disable with --colo[u]r=false or pipe into something else. Ex. 'captree | cat' Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-01Avoid disecting sub-trees of processes in captree output.Andrew G. Morgan1-12/+84
Added --color as an argument to make it easier to spot what you are looking for in the output. This addresses item (2) of: https://bugzilla.kernel.org/show_bug.cgi?id=214269 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-01Don't display duplicate subtrees with captree.Andrew G. Morgan1-0/+8
This addresses issue (1) of: https://bugzilla.kernel.org/show_bug.cgi?id=214269 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-01sucap/su should start with an empty INHERITABLE flag.Andrew G. Morgan1-3/+14
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-01Canonicalize build systemDavid Seifert6-20/+12
* Respect user's CFLAGS/CPPFLAGS/LDFLAGS * Respect $(MAKE) * Remove CPPFLAGS from link rules Note: for in-tree built test binaries, where we build --static, we do not apply LDFLAGS: we want to limit external dependencies in general; and users' LDFLAGS have a strong tendency to conflict with --static for linking. Work in collaboration with David Seifert (ie, he wrote most of it). Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-01cap_iab.3 doc fixes and cleanupAndrew G. Morgan1-34/+31
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-09-01Permit root to run test_pam_cap without arguments.Andrew G. Morgan1-1/+6
This fixes a bug preventing 'make test' from working when invoked by root. Bug reported by David Seifert: https://bugzilla.kernel.org/show_bug.cgi?id=214257 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-31Move $(LDFLAGS) earlier in build command lines.Andrew G. Morgan3-13/+15
As explained (thanks David Seifert) there are some LDFLAGS that need to precede actual linked libraries. For example, -Wl,--as-needed. Given this, I've tried it and it appears to work for the default build cases as captured in 'make distcheck'. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-31Resurrect the $(WARNINGS) for the target buildAndrew G. Morgan2-6/+6
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-30Be more consistent with make variables.Andrew G. Morgan4-25/+27
Noticed that we weren't applying the same amount of flag discipline to local BUILD_* tool rules. Fixing that, I see we've been carrying a source code issue in libcap/_makenames.c for a while. (FIXED). Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-29Up the release version to 2.55v1.2.55psx/v1.2.55libcap-korg-2.55libcap-2.55cap/v1.2.55Andrew G. Morgan8-10/+10
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-29Update man pages.Andrew G. Morgan5-30/+50
Some fixes, some more efficient URLs, some more coherrent cross-references. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-29Add captree command line options and support process by name.Andrew G. Morgan3-9/+117
Add some features to captree. I plan to post a companion article here: https://sites.google.com/site/fullycapable/captree Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-28Make sudotest more robust against untestable environmentsAndrew G. Morgan7-9/+41
I'm setting up some testing environments and they are not all created equal. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-28Avoid the build server failure.Andrew G. Morgan2-9/+19
I figured out that the key ingredient to reproducing this issue was: make COPTS="-D_FORTIFY_SOURCE=2 -O1 -g" clean test Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-27Still unclear where cap_test is crashing.Andrew G. Morgan1-0/+28
Add more debug logging. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-27Speculative fix for build failure.Andrew G. Morgan3-6/+16
Not sure exactly what is causing the build server to fail (can't reproduce yet), but add some extra padding to a calloc and also some test debugging printf()s. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-27Implement libcap:cap_proc_root() function.Andrew G. Morgan4-4/+74
This is needed to locally configure libcap to find the pid data if the proc filesystem is not mounted at "/proc" (rare). Currently libcap only uses this info to implement cap_iab_get_pid(). This brings libcap back to parity with the Go "cap" package. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-27More fixes for static analysis issues.Andrew G. Morgan9-38/+199
Further observations from Zoltan Fridrich's static analysis of libcap. This commit also includes a fix for something I broke with the last round of "fixing", and a test to make sure I don't make that mistake again. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-26Stop installing the cap and psx packages, but do install captree.Andrew G. Morgan3-7/+33
We also add the cap.ProcRoot() API to let the user redirect to their local /proc/ directory - in case anyone runs with an unusual setup like that. I've been studying the downstream package definitions and no one it doesn't seem popular to build the Go packages. Indeed, Go folk themselves prefer to install via modules anyway, so we're getting with the program. However, if folk want to build test the Go stuff as part of a package build and run an install as well, we reward them with the 'captree' binary. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-26Eliminate an alignment issue found by clang.Andrew G. Morgan2-79/+81
Clang helpfully noticed that libcap allocated things should be 64-bit aligned on 64-bit platforms. Restructure the memory allocation to ensure this. Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=214183 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-26Fix some static analysis results.Andrew G. Morgan11-8/+69
This series of issues was found by Zoltan Fridrich. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-25Up the release version to 2.54v1.2.54psx/v1.2.54libcap-korg-2.54libcap-2.54cap/v1.2.54Andrew G. Morgan8-10/+10
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-25Add a comment about overriding DYNAMIC.Andrew G. Morgan1-0/+1
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-25Support overriding choice of 'sudo'.Andrew G. Morgan5-17/+18
Use something like: make SUDO=my_sudo sudotest Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-25Add some more information to help, and contextual error messages.Andrew G. Morgan1-7/+21
This was inspired by a feature Debian has been patching orginally credited to Zhi Li. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-25Absorb some of archlinux's Make.Rule customizations.Andrew G. Morgan1-1/+9
These allow overriding of the sbin target directory with make sbindir=xxx or make sbin=xxx We've recently made some CPPFLAGS changes, so I'm not going to disturb those further this iteration. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-25Address a compiler warning with the tests/uns_test.Andrew G. Morgan1-1/+3
We're comfortable ignoring a write return code, but not all compilers are so display a comment when the write in the uns_test fails. This addresses: https://bugzilla.kernel.org/show_bug.cgi?id=214143 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-23Make 'progs/getpcaps --iab' act like 'go/captree' in output formatAndrew G. Morgan1-12/+23
The combined options 'getpcaps --iab --verbose' will show everything in detail (even the boring stuff). Also used this exercise to test the libcap changes for iab comparisons. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-23Revert most of the LDFLAGS -> LDSTATIC change.Andrew G. Morgan2-11/+17
The intention was to force --static linking in only one corner case, so be more explicit about that one, and revert the build behavior in the others. Reason for doing this was feedback from Arnout Vandecappelle in: https://bugzilla.kernel.org/show_bug.cgi?id=214023#c16 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-23Allow the builder to force -lpam linkage.Andrew G. Morgan2-7/+25
I've yet to understand why this is needed. But, apparently, folk feel strongly that there is a reason one might want to force it one way or another. If you don't care one way or the other, let the Makefiles figure out something that works. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-23libcap/Makefile: don't overwrite 'empty' when generating loader.txtArnout Vandecappelle (Essensium/Mind)1-1/+1
objcopy takes an input file and an output file as arguments. If the output file is left out, the input file will be overwritten. Since the objcopy command used to generate loader.txt only does a dump-section and no filtering, in practice there is no change to empty. However, as a side-effect, its timestamp is updated. The timestamp of empty and of loader.txt will be more or less the same; however, loader.txt is closed just before the output file is closed, so it's possible that the timestamp of loader.txt is just a little bit earlier. If this happens, it causes loader.txt to be rebuilt later, which in turn causes a number of other object files to be rebuilt. Usually that's harmless, but it sometimes causes the rebuild to happen during 'make install'. This is particularly annoying if 'make install' is done as root, since loader.txt becomes owned by root in that case. Fix this by specifying a harmless output file: /dev/null. Fixes: ee3b25c0a877fa74d1aec88f325ac45b09963c82 Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-22Add cap_iab_{compare,get_pid} functions to libcap; --iab to getpcaps.Andrew G. Morgan10-8/+175
This brings libcap back to parity with the Go 'cap' package. We provide a CAP_IAB_DIFFERS(result, vector) macro to evaluate the result of cap_iab_compare(). Extend the getpcaps arguments to include --iab. This causes the utility to explore the IAB tuple for the specified process. When used, this outputs a text representation in a similar format to that of the 'captree' (Go) utility. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-22Add the captree example.Andrew G. Morgan4-2/+331
This is a small command line utility for doing something like pstree but focused on revealing the full capability state of the processes and threads shown. This requires support provided in the cap.IABGetPID() function which will debut in libcap-2.54. For now, the binary is only buildable from HEAD in the git repository. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-22Revamp the comparison API of *Set and *IAB tuples; add IABGetPID().Andrew G. Morgan5-13/+157
Older APIs remain but are documented as deprecated. If we ever need to release a golang version "2" version of the library, I'll drop support for deprecated functions, but I have no intention of needing to do that. In the mean time, the deprecated functions are wrappers around the new functions. New API: *Set and *IAB have .Cf() functions now. That return a [IAB]Diff value. This value, if 0, means the compared pointers match one another. Non-zero values can be interogated with the ([IAB]Diff).Has() functions. Also, add an IABGetPID() function. Since the kernel provides no syscall support for this, we have to resort to parsing the /proc/ files. Implemented mostly for parity with the syscall backed GetPID() *Set returning API. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-22Fix error code handling for failed cap_reset_ambient()Andrew G. Morgan1-8/+3
Looks like the system call wrapper wasn't migrated properly when I added support to get fakeroot ( https://bugzilla.kernel.org/show_bug.cgi?id=206539 ) working again. That is, all builds in the inclusive range libcap-[2.28, 2.53] have this issue. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-21Handle libcap allocation failures more explicitly and fix a memory leak.Andrew G. Morgan4-22/+66
This started out as a refactoring of a patch provided by Samanta Navarro. Reworked, I noticed a latent memory leak in cap_iab_get_proc(), so I've fixed that too. Also, migrated a compile failure check to a more useful cap_test for a highly unlikely corner case (future proofing). While there, noticed and fixed the binary search test and code (not sure what it was testing before). Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-21Check return values of allocating functionsSamanta Navarro1-0/+12
The calloc and asprintf functions can return NULL if not enough memory is available. The majority of the code base checks for this condition already. Signed-off-by: Samanta Navarro <ferivoz@riseup.net> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-21Fix endless loop with very long stringsSamanta Navarro1-1/+1
If a string with more than UINT_MAX characters is passed into cap_from_text, then an endless loop occurs in lookupname. This is clearly an edge case but the fix is very simple as well: Use size_t instead of unsigned. Signed-off-by: Samanta Navarro <ferivoz@riseup.net> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-19Drop non-standard IPATH in favor of CPPFLAGS.Andrew G. Morgan5-23/+31
This also required locally augmenting CFLAGS with -fPIC in the Makefile's that required it. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-19Make lib*.so files executable.Andrew G. Morgan1-2/+2
Since 2.52 these libraries have supported being run as binaries so install them as such. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-15Up the release version to 2.53v1.2.53psx/v1.2.53libcap-korg-2.53libcap-2.53cap/v1.2.53Andrew G. Morgan7-9/+9
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-14Fix typos.Samanta Navarro25-59/+59
Typos found with codespell Signed-off-by: Samanta Navarro <ferivoz@riseup.net> Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-14Complete cap_launch fix.Andrew G. Morgan1-1/+3
Samanta Navarro included this in their suggested fix, but I missed including it in the previous commit. Fixed now. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-14Fix cap_launch failures - error propogation.Andrew G. Morgan2-19/+28
All credit for this fix goes to Samanta Navarro. The launch error propagation code was evidently broken previously. Samanta also provided a proof of concept test case and we've included that in the tests/libcap_launch_test.c. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-13Support distributions that build libcap with aggressive link options.Andrew G. Morgan5-21/+54
Discussion of one such setup in this bug (reported by David Runge): https://bugzilla.kernel.org/show_bug.cgi?id=214023 Work around the failure to run ./pam_cap.so in these cases with some more Makefile magic, and adjust test building with these flags so it works in DYNAMIC=yes|no and SHARED=yes|no cases. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-11Support CC=clang again.Andrew G. Morgan4-4/+7
I didn't realize CC=clang used to work. Now it does again. I've also added a test build for clang in distcheck. This fixes: https://bugzilla.kernel.org/show_bug.cgi?id=214047 Also, add a note about pam_cap.so building after debugging: https://bugzilla.kernel.org/show_bug.cgi?id=214023 Finally, removed a redundant LDFLAGS link directory override. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-10Noticed that this pam_cap/Makefile comment had unintentionally migratedAndrew G. Morgan1-5/+5
Move it to where it makes sense. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-03Add some documentation concerning the cap.FuncLauncher() behavior.Andrew G. Morgan1-1/+11
Slavi Marinov was asking about how a single webserver might use the cap package to serve different content as a different user? So I realized this detail wasn't obvious from the package documentation. I also put together this example sketch: https://play.golang.org/p/6Hr0XW3JP6a Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-01Up the release version to 2.52v1.2.52psx/v1.2.52libcap-korg-2.52libcap-2.52cap/v1.2.52Andrew G. Morgan7-9/+9
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-01Revive an ancient 'su' implementation to explore use with libcap.Andrew G. Morgan5-511/+638
That is, this 'su' is not to be installed setuid-root. It is intended to be installed `setcap =p su`. With latest PAM sources (ie., newer than Linux-PAM 1.5.1 [*]) and libcap this is able to validate that ambient capabilities can be applied by pam_cap.so. For discussion, see this bug: https://bugzilla.kernel.org/show_bug.cgi?id=212945 Caution. I've done very little auditing of this binary. So, I expect (and will be happy if folk find them) to hear about bugs etc. What makes me excited is to explore the ways in which classic "setuid-root" exploit vectors exhibit with bugs in this code... [*] At the time of writing Linux-PAM 1.5.1 is the latest release and that was before the needed pam_unix.so support was committed. See https://github.com/linux-pam/linux-pam/issues/317#issuecomment-869064103 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-01Import an old version of su from SimplePAMApps-0.60Andrew G. Morgan3-0/+1534
When Linux-PAM was getting its act together (more than two decades ago) we cobbled together a set of system apps and made them use Linux-PAM for authentication. Once Redhat shipped Linux-PAM, the mainstream versions of these apps adopted Linux-PAM and these simple ones withered. I want to explore some pam_cap.so related issues and so I've resurrected one of them, su, which announces itself to libpam with the name "sucap". I'm not sure where I'll go with this yet, but my first goal is to reproduce the issue: https://bugzilla.kernel.org/show_bug.cgi?id=212945 and validate the workaround I've added to that module is sufficient. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-08-01Add a note about cap_launch callback function return values.Andrew G. Morgan1-8/+17
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-07-15Clean up allocated memory.Andrew G. Morgan1-2/+11
Deliberately free memory when appropriate as a normal part of executing a .so object. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-07-14realloc less at startup executing a .so fileAndrew G. Morgan1-2/+2
A small perf optimization for the common case. Mostly, this change is to fix a comment. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-07-13Allow for systems with no /proc/self/cmdline file.Andrew G. Morgan2-2/+2
If /proc/ isn't mounted, the command line won't be available there. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-07-12Clarify some cap_launch documentation.Andrew G. Morgan1-2/+6
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-07-12Support running pam_cap.so as a simple binary.Andrew G. Morgan3-5/+70
This prints module information and supports the sole optional argument --help. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-07-12Support simply executing the built shared libraries.Andrew G. Morgan6-16/+154
Some system libraries support being run as regular executables. Now that I have figured out how to do it, add support for libcap.so and libpsx.so to print some information and exit. Note, I've explained how most of this stuff works in this answer: https://stackoverflow.com/a/68339111/14760867 Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-07-02When --suggest'ing also compare against capability namesAndrew G. Morgan1-0/+10
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
2021-07-02Provide a '--current' command line argument for capsh.Andrew G. Morgan3-13/+33
This is equivalent to 'capsh --print|fgrep Current'. I've been using that combination a lot in the write-ups on the libcap website (https://sites.google.com/site/fullycapable/) and so it struck me that capsh probably should support it natively. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-15 23:41:03 +0000