On Wed, Jan 23, 2019 at 09:36:25PM -0500, Richard Guy Briggs wrote:
> V3 namespaced file capabilities were introduced in
> commit 8db6c34f1dbc ("Introduce v3 namespaced file capabilities")
>
> Add support for these by adding the "frootid" field to the existing
> fcaps fields in the NAME and BPRM_FCAPS records.
>
> Please see github issue
> https://github.com/linux-audit/audit-kernel/issues/103
>
> Signed-off-by: Richard Guy Briggs <[email protected]>
Looks like good info to have,
Acked-by: Serge Hallyn <[email protected]>
> ---
> Passes audit-testsuite.
>
> include/linux/capability.h | 5 +++--
> kernel/audit.c | 6 ++++--
> kernel/audit.h | 1 +
> kernel/auditsc.c | 4 ++++
> security/commoncap.c | 2 ++
> 5 files changed, 14 insertions(+), 4 deletions(-)
>
> diff --git a/include/linux/capability.h b/include/linux/capability.h
> index f640dcbc880c..f6bb691547fd 100644
> --- a/include/linux/capability.h
> +++ b/include/linux/capability.h
> @@ -14,7 +14,7 @@
> #define _LINUX_CAPABILITY_H
>
> #include <uapi/linux/capability.h>
> -
> +#include <linux/uidgid.h>
>
> #define _KERNEL_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3
> #define _KERNEL_CAPABILITY_U32S _LINUX_CAPABILITY_U32S_3
> @@ -25,11 +25,12 @@
> __u32 cap[_KERNEL_CAPABILITY_U32S];
> } kernel_cap_t;
>
> -/* exact same as vfs_cap_data but in cpu endian and always filled completely
> */
> +/* exact same as vfs_ns_cap_data but in cpu endian and always filled
> completely */
> struct cpu_vfs_cap_data {
> __u32 magic_etc;
> kernel_cap_t permitted;
> kernel_cap_t inheritable;
> + kuid_t rootid;
> };
>
> #define _USER_CAP_HEADER_SIZE (sizeof(struct __user_cap_header_struct))
> diff --git a/kernel/audit.c b/kernel/audit.c
> index ca55ccb46b76..6f5eeb658ccb 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -2083,8 +2083,9 @@ static void audit_log_fcaps(struct audit_buffer *ab,
> struct audit_names *name)
> {
> audit_log_cap(ab, "cap_fp", &name->fcap.permitted);
> audit_log_cap(ab, "cap_fi", &name->fcap.inheritable);
> - audit_log_format(ab, " cap_fe=%d cap_fver=%x",
> - name->fcap.fE, name->fcap_ver);
> + audit_log_format(ab, " cap_fe=%d cap_fver=%x cap_frootid=%d",
> + name->fcap.fE, name->fcap_ver,
> + from_kuid(&init_user_ns, name->fcap.rootid));
> }
>
> static inline int audit_copy_fcaps(struct audit_names *name,
> @@ -2103,6 +2104,7 @@ static inline int audit_copy_fcaps(struct audit_names
> *name,
> name->fcap.permitted = caps.permitted;
> name->fcap.inheritable = caps.inheritable;
> name->fcap.fE = !!(caps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
> + name->fcap.rootid = caps.rootid;
> name->fcap_ver = (caps.magic_etc & VFS_CAP_REVISION_MASK) >>
> VFS_CAP_REVISION_SHIFT;
>
> diff --git a/kernel/audit.h b/kernel/audit.h
> index 6ffb70575082..deefdbe61a47 100644
> --- a/kernel/audit.h
> +++ b/kernel/audit.h
> @@ -69,6 +69,7 @@ struct audit_cap_data {
> kernel_cap_t effective; /* effective set of process */
> };
> kernel_cap_t ambient;
> + kuid_t rootid;
> };
>
> /* When fs/namei.c:getname() is called, we store the pointer in name and bump
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index b585ceb2f7a2..461c52eff870 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -1358,6 +1358,9 @@ static void audit_log_exit(void)
> audit_log_cap(ab, "pi", &axs->new_pcap.inheritable);
> audit_log_cap(ab, "pe", &axs->new_pcap.effective);
> audit_log_cap(ab, "pa", &axs->new_pcap.ambient);
> + audit_log_format(ab, " frootid=%d",
> + from_kuid(&init_user_ns,
> + axs->fcap.rootid));
> break; }
>
> }
> @@ -2355,6 +2358,7 @@ int __audit_log_bprm_fcaps(struct linux_binprm *bprm,
> ax->fcap.permitted = vcaps.permitted;
> ax->fcap.inheritable = vcaps.inheritable;
> ax->fcap.fE = !!(vcaps.magic_etc & VFS_CAP_FLAGS_EFFECTIVE);
> + ax->fcap.rootid = vcaps.rootid;
> ax->fcap_ver = (vcaps.magic_etc & VFS_CAP_REVISION_MASK) >>
> VFS_CAP_REVISION_SHIFT;
>
> ax->old_pcap.permitted = old->cap_permitted;
> diff --git a/security/commoncap.c b/security/commoncap.c
> index 232db019f051..c097f3568001 100644
> --- a/security/commoncap.c
> +++ b/security/commoncap.c
> @@ -643,6 +643,8 @@ int get_vfs_caps_from_disk(const struct dentry *dentry,
> struct cpu_vfs_cap_data
> cpu_caps->permitted.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
> cpu_caps->inheritable.cap[CAP_LAST_U32] &= CAP_LAST_U32_VALID_MASK;
>
> + cpu_caps->rootid = rootkuid;
> +
> return 0;
> }
>
> --
> 1.8.3.1
