Linux capability初探

关于capability，可参考这里
第一个文件,cap.c

#include "cap.h"                                                                                                                                                                                                                                                                                                                                                                        
void showCap(pid_t pid)                                                                                                                           
{                                                                                                                                                 
     struct __user_cap_header_struct cap_header_data;                                                                                             
     cap_user_header_t cap_header = &cap_header_data;                                                                                             
                                                                                                                                                  
     struct __user_cap_data_struct cap_data_data;                                                                                                 
     cap_user_data_t cap_data = &cap_data_data;                                                                                                   
                                                                                                                                                  
     cap_header->pid = pid;                                                                                                                       
     cap_header->version = _LINUX_CAPABILITY_VERSION_1;                                                                                           
                                                                                                                                                  
     if (capget(cap_header, cap_data) < 0) {                                                                                                      
         perror("Failed capget");                                                                                                                 
         exit(1);                                                                                                                                 
     }                                                                                                                                            
     printf("pid %d, Cap data 0x%x, 0x%x, 0x%x\n", pid,cap_data->effective, cap_data->permitted, cap_data->inheritable);                          
}                                                                                                                                                 
                                                                                                                                                  
void setCap(pid_t pid)                                                                                                                            
{                                                                                                                                                 
     struct __user_cap_header_struct cap_header_data;                                                                                             
     cap_user_header_t cap_header = &cap_header_data;                                                                                             
                                                                                                                                                  
     struct __user_cap_data_struct cap_data_data;                                                                                                 
     cap_user_data_t cap_data = &cap_data_data;                                                                                                   
                                                                                                                                                  
     cap_header->pid = pid;                                                                                                                       
     cap_header->version = _LINUX_CAPABILITY_VERSION_1;                                                                                           
                                                                                                                                                  
     if (capget(cap_header, cap_data) < 0) {                                                                                                      
         perror("Failed capget");                                                                                                                 
         exit(1);                                                                                                                                 
     }                                                                                                                                            
                                                                                                                                                  
    cap_data->effective &= ~(1 << CAP_NET_ADMIN);                                                                                                 
    cap_data->permitted &= ~(1 << CAP_NET_ADMIN);                                                                                                 
    cap_data->inheritable &= ~(1 << CAP_NET_ADMIN);                                                                                               
                                                                                                                                                  
    printf("setCap pid %d, Cap data 0x%x, 0x%x, 0x%x\n", pid,cap_data->effective, cap_data->permitted, cap_data->inheritable);                    
                                                                                                                                                  
     if (capset(cap_header, cap_data) < 0) {                                                                                                      
         perror("Failed capset");                                                                                                                 
         exit(1);                                                                                                                                 
     }                                                                                                                                            
}                                                                                                                                                                                                                                                     

第二个文件，main.c

 #include "cap.h"                                                                                               
                                                                                                                
 int main()                                                                                                     
 {                                                                                                              
     pid_t pid;                                                                                                                                                                                                             
     pid = fork();                                                                                                                                                                                                       
     if(pid == 0) {                                                                                                                 
         //setCap(getpid());  /*注释2*/                                                                                 
         execve("./test", NULL, NULL);                                                                          
     }                                                                                                          
     else {                                                                                                     
         printf("in father pid = %d, child pid = %d, uid = %d, gid = %d\n", getpid(), pid, getuid(), getgid()); 
         //setCap(pid);   /*注释1*/                                                                                      
     }                                                                                                                                                                                                                  
     return 0;                                                                                                  
 }                                                                                                                                                                                                                          

第三个文件 test.c

#include "cap.h"                              
                                            
int main (int argc, char** argv) {            
    printf("in test");                        
    //setCap(getpid());    /*注释3*/                     
    while (1) {                               
        sleep (10);                           
        showCap(getpid());                    
    }                                         
    return 0;                                 
}                                             

Make file：

all:    install                                                                                             
CC = gcc                                                                                                       
INCLUDE = .                                                                                                
INSTDIR = $(PWD)/                                                                                         
main:   main.c cap.c cap.h                               
        $(CC) -o main main.c cap.c cap.h -lcap                                                            
test:   test.c cap.c cap.h                               
        $(CC) -o test test.c  cap.c cap.h -lcap                                                                                                               
clean:                                                   
        @ -rm $(INSTDIR) -r                                                                                 
install:        main    test                             

前提：只有root权限才可以set capability
只打开注释1
sudo ./main
输出：

in father pid = 3605, child pid = 3606, uid = 0, gid = 0
setCap pid 3606, Cap data 0xffffefff, 0xffffefff, 0x0
Failed capset: Operation not permitted

即使拥有root权限，也们没有权限修改其他进程capability

只打开注释2
sudo ./main
输出：

in father pid = 3630, child pid = 3631, uid = 0, gid = 0
setCap pid 3631, Cap data 0xffffefff, 0xffffefff, 0x0
in test
pid 3631, Cap data 0xffffffff, 0xffffffff, 0x0

进程可以修改自身capability，但execve()执行后，替换了进程img，capability也被重置。

只打开注释2
sudo ./main
输出：

in father pid = 3667, child pid = 3668, uid = 0, gid = 0
in test
setCap pid 3668, Cap data 0xffffefff, 0xffffefff, 0x0
pid 3668, Cap data 0xffffefff, 0xffffefff, 0x0

进程修改自身capability，要在execve()之后，才可以成功。

修改test.c

#include "cap.h"                           
                                          
int main (int argc, char** argv) {         
    printf("in test\n");                   
    setCap(getpid());   /*注释3*/            
    setuid(1000);           
    while (1) {                            
        sleep (10);                        
        showCap(getpid());                 
    }                                      
    return 0;                              
}                                                                                    

sudo ./main
输出：

in father pid = 3708, child pid = 3709, uid = 0, gid = 0
in test
setCap pid 3709, Cap data 0xffffefff, 0xffffefff, 0x0
pid 3709, Cap data 0x0, 0x0, 0x0

从root变为普通用户后，进程自身的capability被clear
那么如何才能使得capability在user变化后保持不变。通过pctrl()
修改main.c

int main (int argc, char** argv)                    
{                                                   
    int ret = 0;                                    
    printf("in test\n");                            
    //setCap(getpid()); /*注释3*/                     
                                                    
    ret = prctl(PR_SET_KEEPCAPS, 1);                
    if (ret) {                                      
        perror("prctl");                            
        return -1;                                  
   }                                                                                          
    printf("before set uid 1000\n");                
    showCap(getpid());                              
    setuid(1000);                                   
    setCap(getpid());   /*注释3*/                     
    printf("after set uid 1000\n");                 
    while (1) {                                     
        sleep (10);                                 
        showCap(getpid());                          
    }                                               
    return 0;                                       
}                                                   

sudo ./main
输出：

before set uid 1000                            
pid 97, Cap data 0xffffffff, 0xffffffff, 0x0   
setCap pid 97, Cap data 0x0, 0xffffefff, 0x0   
after set uid 1000                             
pid 97, Cap data 0x0, 0xffffefff, 0x0          

可以看到在setuid之前调用prctl(PR_SET_KEEPCAPS, 1);,使得Permitted得以保留，但为什么Effective没有被保留？留个疑问吧
如果想改变Effective的值，修改cap.c的setCap函数：

 	cap_data->permitted &= ~(1 << CAP_NET_ADMIN);     
   //cap_data->effective &= ~(1 << CAP_NET_ADMIN); 
   cap_data->effective = cap_data->permitted;      
   cap_data->inheritable &= ~(1 << CAP_NET_ADMIN); 

得到输出：

before set uid 1000
pid 120, Cap data 0xffffffff, 0xffffffff, 0x0
setCap pid 120, Cap data 0xffffefff, 0xffffefff, 0x0
after set uid 1000
pid 120, Cap data 0xffffefff, 0xffffefff, 0x0

可以看到，虽然程序已经不是root权限，但依旧可以set Effective的值。