98 lines
3.2 KiB
Rust
98 lines
3.2 KiB
Rust
|
use std::io;
|
||
|
|
|
||
|
|
use rustix::thread::{
|
||
|
|
CapabilitySet, CapabilitySets, capabilities, capability_is_in_ambient_set,
|
||
|
|
capability_is_in_bounding_set, configure_capability_in_ambient_set,
|
||
|
|
remove_capability_from_bounding_set, set_capabilities,
|
||
|
|
};
|
||
|
|
|
||
|
|
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
|
||
|
|
pub struct CapabilityState {
|
||
|
|
pub sets: CapabilitySets,
|
||
|
|
pub ambient: bool,
|
||
|
|
pub bounding: bool,
|
||
|
|
}
|
||
|
|
|
||
|
|
/// # Errors
|
||
|
|
/// Returns an error when any kernel capability set cannot be inspected.
|
||
|
|
pub fn inspect(capability: CapabilitySet) -> io::Result<CapabilityState> {
|
||
|
|
Ok(CapabilityState {
|
||
|
|
sets: capabilities(None)?,
|
||
|
|
ambient: capability_is_in_ambient_set(capability)?,
|
||
|
|
bounding: capability_is_in_bounding_set(capability)?,
|
||
|
|
})
|
||
|
|
}
|
||
|
|
|
||
|
|
/// # Errors
|
||
|
|
/// Refuses any incomplete set, bounding, ambient, or secure-bit transition.
|
||
|
|
pub fn irreversibly_drop(capability: CapabilitySet) -> io::Result<()> {
|
||
|
|
require_single_threaded_process()?;
|
||
|
|
let before = inspect(capability)?;
|
||
|
|
if before.bounding && !before.sets.effective.contains(CapabilitySet::SETPCAP) {
|
||
|
|
return Err(io::Error::from_raw_os_error(1));
|
||
|
|
}
|
||
|
|
if before.ambient {
|
||
|
|
configure_capability_in_ambient_set(capability, false)?;
|
||
|
|
}
|
||
|
|
if before.bounding {
|
||
|
|
remove_capability_from_bounding_set(capability)?;
|
||
|
|
}
|
||
|
|
let mut sets = before.sets;
|
||
|
|
sets.effective.remove(capability);
|
||
|
|
sets.permitted.remove(capability);
|
||
|
|
sets.inheritable.remove(capability);
|
||
|
|
if sets != before.sets {
|
||
|
|
set_capabilities(None, sets)?;
|
||
|
|
}
|
||
|
|
let observed = inspect(capability)?;
|
||
|
|
if observed.sets.effective.intersects(capability)
|
||
|
|
|| observed.sets.permitted.intersects(capability)
|
||
|
|
|| observed.sets.inheritable.intersects(capability)
|
||
|
|
|| observed.ambient
|
||
|
|
|| observed.bounding
|
||
|
|
{
|
||
|
|
return Err(io::Error::other(
|
||
|
|
"capability remained available after irreversible drop",
|
||
|
|
));
|
||
|
|
}
|
||
|
|
Ok(())
|
||
|
|
}
|
||
|
|
|
||
|
|
fn require_single_threaded_process() -> io::Result<()> {
|
||
|
|
let mut tasks = std::fs::read_dir("/proc/self/task")?;
|
||
|
|
if tasks.next().transpose()?.is_some() && tasks.next().transpose()?.is_none() {
|
||
|
|
Ok(())
|
||
|
|
} else {
|
||
|
|
Err(io::Error::other(
|
||
|
|
"capability transition requires a single-threaded process",
|
||
|
|
))
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
#[cfg(test)]
|
||
|
|
mod tests {
|
||
|
|
use rustix::thread::CapabilitySet;
|
||
|
|
|
||
|
|
use super::{inspect, irreversibly_drop};
|
||
|
|
|
||
|
|
#[test]
|
||
|
|
fn inspects_current_capability_sets() {
|
||
|
|
let state = inspect(CapabilitySet::NET_ADMIN).unwrap();
|
||
|
|
assert_eq!(
|
||
|
|
state.sets.effective.contains(CapabilitySet::NET_ADMIN),
|
||
|
|
state.sets.effective.intersects(CapabilitySet::NET_ADMIN)
|
||
|
|
);
|
||
|
|
}
|
||
|
|
|
||
|
|
#[test]
|
||
|
|
fn multithreaded_process_refuses_before_transition() {
|
||
|
|
let before = inspect(CapabilitySet::NET_ADMIN).unwrap();
|
||
|
|
let waiting = std::sync::Arc::new(std::sync::Barrier::new(2));
|
||
|
|
let child_waiting = std::sync::Arc::clone(&waiting);
|
||
|
|
let child = std::thread::spawn(move || child_waiting.wait());
|
||
|
|
assert!(irreversibly_drop(CapabilitySet::NET_ADMIN).is_err());
|
||
|
|
assert_eq!(inspect(CapabilitySet::NET_ADMIN).unwrap(), before);
|
||
|
|
waiting.wait();
|
||
|
|
child.join().unwrap();
|
||
|
|
}
|
||
|
|
}
|