linux内核capable源代码分析

桃扇骨 2022-08-21 02:24 418阅读 0赞

linux内核里对于进程的权限管理有一个很重要的函数capable，以前看了好多遍，今天下决心搞定他，也在此立下一个碑，以后有谁想搞明白他的话，我还可以提供一些帮助。
capable函数定义在kernel/capability.c，作用是检验当前进程有没有相应的权限，定义如下 

  1. int capable(int cap)
  2. {
  3.     return __capable(current, cap);
  4. }

继续看__capable函数，这个函数也定义在kernel/capability.c，定义如下 

  1. int __capable(struct task_struct *t, int cap)
  2. {
  3.     /*首先执行security_capable函数检查，如果成功就给进程的flags置位，标志获得超级权限，PF_SUPERPRIV定义如下
  4.     #define PF_SUPERPRIV    0x00000100    /* used super-user privileges */就是超级用户的意思
  5.     */
  6.     if (security_capable(t, cap) == 0) {
  7.         t->flags |= PF_SUPERPRIV;
  8.         return 1;
  9.     }
  10.     return 0;
  11. }

我们继续看security_capable函数，定义在linux/security.h 

  1. static inline int security_capable(struct task_struct *tsk, int cap)
  2. {
  3.     return cap_capable(tsk, cap);
  4. }

继续看cap_capable函数，定义在security/commonncap.c 

  1. int cap_capable (struct task_struct *tsk, int cap)
  2. {
  3.     /* 权限检查的主要工作函数 */
  4.     if (cap_raised(tsk->cap_effective, cap))
  5.         return 0;
  6.     return -EPERM;
  7. }

我们继续看cap_raised，这是一个宏，定义如下
#define CAP_TO_MASK(x) (1 << (x))
#define cap_raise(c, flag) (cap_t(c) |= CAP_TO_MASK(flag))
#define cap_lower(c, flag) (cap_t(c) &= ~CAP_TO_MASK(flag))
#define cap_raised(c, flag) (cap_t(c) & CAP_TO_MASK(flag))
所以可以看出cap_capable函数就是查看task_struct的cap_effective变量，然后与(1<<cap)执行按位与操作。
cap_effective变量就是进程结构体里的一个32位的int变量，每一个位代表一个权限，定义如下 

  1. /**
  2.  ** POSIX-标准定义的权限能力
  3.  **/
  6. #define CAP_CHOWN            0
  9. /* Override all DAC access, including ACL execute access if
  10.    [_POSIX_ACL] is defined. Excluding DAC access covered by
  11.    CAP_LINUX_IMMUTABLE. */
  14. #define CAP_DAC_OVERRIDE     1
  17. /* Overrides all DAC restrictions regarding read and search on files
  18.    and directories, including ACL restrictions if [_POSIX_ACL] is
  19.    defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. */
  22. #define CAP_DAC_READ_SEARCH  2
  24. /* Overrides all restrictions about allowed operations on files, where
  25.    file owner ID must be equal to the user ID, except where CAP_FSETID
  26.    is applicable. It doesn't override MAC and DAC restrictions. */
  29. #define CAP_FOWNER           3
  32. /* Overrides the following restrictions that the effective user ID
  33.    shall match the file owner ID when setting the S_ISUID and S_ISGID
  34.    bits on that file; that the effective group ID (or one of the
  35.    supplementary group IDs) shall match the file owner ID when setting
  36.    the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are
  37.    cleared on successful return from chown(2) (not implemented). */
  40. #define CAP_FSETID           4
  43. /* Used to decide between falling back on the old suser() or fsuser(). */
  46. #define CAP_FS_MASK          0x1f
  49. /* Overrides the restriction that the real or effective user ID of a
  50.    process sending a signal must match the real or effective user ID
  51.    of the process receiving the signal. */
  54. #define CAP_KILL             5
  57. /* Allows setgid(2) manipulation */
  58. /* Allows setgroups(2) */
  59. /* Allows forged gids on socket credentials passing. */
  62. #define CAP_SETGID           6
  65. /* Allows set*uid(2) manipulation (including fsuid). */
  66. /* Allows forged pids on socket credentials passing. */
  69. #define CAP_SETUID           7
  74. /**
  75.  ** Linux-specific capabilities
  76.  **/
  79. /* Transfer any capability in your permitted set to any pid,
  80.    remove any capability in your permitted set from any pid */
  83. #define CAP_SETPCAP          8
  86. /* Allow modification of S_IMMUTABLE and S_APPEND file attributes */
  89. #define CAP_LINUX_IMMUTABLE  9
  92. /* Allows binding to TCP/UDP sockets below 1024 */
  93. /* Allows binding to ATM VCIs below 32 */
  96. #define CAP_NET_BIND_SERVICE 10
  99. /* Allow broadcasting, listen to multicast */
  102. #define CAP_NET_BROADCAST    11
  105. /* Allow interface configuration */
  106. /* Allow administration of IP firewall, masquerading and accounting */
  107. /* Allow setting debug option on sockets */
  108. /* Allow modification of routing tables */
  109. /* Allow setting arbitrary process / process group ownership on
  110.    sockets */
  111. /* Allow binding to any address for transparent proxying */
  112. /* Allow setting TOS (type of service) */
  113. /* Allow setting promiscuous mode */
  114. /* Allow clearing driver statistics */
  115. /* Allow multicasting */
  116. /* Allow read/write of device-specific registers */
  117. /* Allow activation of ATM control sockets */
  120. #define CAP_NET_ADMIN        12
  123. /* Allow use of RAW sockets */
  124. /* Allow use of PACKET sockets */
  127. #define CAP_NET_RAW          13
  130. /* Allow locking of shared memory segments */
  131. /* Allow mlock and mlockall (which doesn't really have anything to do
  132.    with IPC) */
  135. #define CAP_IPC_LOCK         14
  138. /* Override IPC ownership checks */
  141. #define CAP_IPC_OWNER        15
  144. /* Insert and remove kernel modules - modify kernel without limit */
  145. /* Modify cap_bset */
  146. #define CAP_SYS_MODULE       16
  149. /* Allow ioperm/iopl access */
  150. /* Allow sending USB messages to any device via /proc/bus/usb */
  153. #define CAP_SYS_RAWIO        17
  156. /* Allow use of chroot() */
  159. #define CAP_SYS_CHROOT       18
  162. /* Allow ptrace() of any process */
  165. #define CAP_SYS_PTRACE       19
  168. /* Allow configuration of process accounting */
  171. #define CAP_SYS_PACCT        20
  174. /* Allow configuration of the secure attention key */
  175. /* Allow administration of the random device */
  176. /* Allow examination and configuration of disk quotas */
  177. /* Allow configuring the kernel's syslog (printk behaviour) */
  178. /* Allow setting the domainname */
  179. /* Allow setting the hostname */
  180. /* Allow calling bdflush() */
  181. /* Allow mount() and umount(), setting up new smb connection */
  182. /* Allow some autofs root ioctls */
  183. /* Allow nfsservctl */
  184. /* Allow VM86_REQUEST_IRQ */
  185. /* Allow to read/write pci config on alpha */
  186. /* Allow irix_prctl on mips (setstacksize) */
  187. /* Allow flushing all cache on m68k (sys_cacheflush) */
  188. /* Allow removing semaphores */
  189. /* Used instead of CAP_CHOWN to "chown" IPC message queues, semaphores
  190.    and shared memory */
  191. /* Allow locking/unlocking of shared memory segment */
  192. /* Allow turning swap on/off */
  193. /* Allow forged pids on socket credentials passing */
  194. /* Allow setting readahead and flushing buffers on block devices */
  195. /* Allow setting geometry in floppy driver */
  196. /* Allow turning DMA on/off in xd driver */
  197. /* Allow administration of md devices (mostly the above, but some
  198.    extra ioctls) */
  199. /* Allow tuning the ide driver */
  200. /* Allow access to the nvram device */
  201. /* Allow administration of apm_bios, serial and bttv (TV) device */
  202. /* Allow manufacturer commands in isdn CAPI support driver */
  203. /* Allow reading non-standardized portions of pci configuration space */
  204. /* Allow DDI debug ioctl on sbpcd driver */
  205. /* Allow setting up serial ports */
  206. /* Allow sending raw qic-117 commands */
  207. /* Allow enabling/disabling tagged queuing on SCSI controllers and sending
  208.    arbitrary SCSI commands */
  209. /* Allow setting encryption key on loopback filesystem */
  210. /* Allow setting zone reclaim policy */
  213. #define CAP_SYS_ADMIN        21
  216. /* Allow use of reboot() */
  219. #define CAP_SYS_BOOT         22
  222. /* Allow raising priority and setting priority on other (different
  223.    UID) processes */
  224. /* Allow use of FIFO and round-robin (realtime) scheduling on own
  225.    processes and setting the scheduling algorithm used by another
  226.    process. */
  227. /* Allow setting cpu affinity on other processes */
  230. #define CAP_SYS_NICE         23
  233. /* Override resource limits. Set resource limits. */
  234. /* Override quota limits. */
  235. /* Override reserved space on ext2 filesystem */
  236. /* Modify data journaling mode on ext3 filesystem (uses journaling
  237.    resources) */
  238. /* NOTE: ext2 honors fsuid when checking for resource overrides, so 
  239.    you can override using fsuid too */
  240. /* Override size restrictions on IPC message queues */
  241. /* Allow more than 64hz interrupts from the real-time clock */
  242. /* Override max number of consoles on console allocation */
  243. /* Override max number of keymaps */
  246. #define CAP_SYS_RESOURCE     24
  249. /* Allow manipulation of system clock */
  250. /* Allow irix_stime on mips */
  251. /* Allow setting the real-time clock */
  254. #define CAP_SYS_TIME         25
  257. /* Allow configuration of tty devices */
  258. /* Allow vhangup() of tty */
  261. #define CAP_SYS_TTY_CONFIG   26
  264. /* Allow the privileged aspects of mknod() */
  267. #define CAP_MKNOD            27
  270. /* Allow taking of leases on files */
  273. #define CAP_LEASE            28
  276. #define CAP_AUDIT_WRITE      29
  279. #define CAP_AUDIT_CONTROL    30

检验权限的时候，就检查进程结构体task_struct对应的位是不是1就ok了。

发表评论

表情：
评论列表 （有 0 条评论，418人围观）

还没有评论，来说两句吧...

相关阅读

    相关 查看linux内核源代码

    这里介绍的就是通过自己的虚拟机进去查看你linux系统的内核源代码，当然也可以去网站下载，自己按需使用 1.源码路径 一般路径都是在根目录下的/usr/src下，其

    灰太狼灰太狼/ 0 赞/ 21 阅读

    相关 linux内核capable源代码分析

    linux内核里对于进程的权限管理有一个很重要的函数capable，以前看了好多遍，今天下决心搞定他，也在此立下一个碑，以后有谁想搞明白他的话，我还可以提供一些帮助。 ca

    桃扇骨桃扇骨/ 0 赞/ 419 阅读

    相关 linux内核read操作源代码分析

    read操作是任何操作系统里的基本操作，我们来看一下在linux内核里，read文件是怎样实现的。 read函数在用户空间是由read系统调用实现的，由编译器编译成软中断i

    悠悠悠悠/ 0 赞/ 375 阅读