-
Notifications
You must be signed in to change notification settings - Fork 0
/
notes.txt
134 lines (102 loc) · 4.8 KB
/
notes.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
https://lwn.net/Articles/747039/
http://www.openwall.com/lists/kernel-hardening/2017/09/22/3
https://stackoverflow.com/questions/27866395/in-kernel-program-get-root-user-id-and-compare-with-current-user-id
-------------------------------------------------------------
Find/set the values for CAP_NET_BIND_SERVICE
-------------------------------------------------------------
Get the creds for the current task and set accordingly...
CAP_NET_BIND_SERVICE grant values are: perm and effective = 1024
printk(KERN_INFO "CAP_TO_INDEX: %u CAP_TO_MASK: %u\n",CAP_TO_INDEX(CAP_NET_BIND_SERVICE),CAP_TO_MASK(CAP_NET_BIND_SERVICE));
/* raw capabilities info */
printk(KERN_INFO "capabilities, inh[0]=%u inh[1]=%u per[0]=%u per[1]=%u eff[0]=%u eff[1]%u bset[0]=%u bset[1]=%u",
creds->cap_inheritable.cap[0], creds->cap_inheritable.cap[1],
creds->cap_permitted.cap[0], creds->cap_permitted.cap[1],
creds->cap_effective.cap[0], creds->cap_effective.cap[1],
creds->cap_bset.cap[0], creds->cap_bset.cap[1]);
/* `current` is a macro: defined in arch/x86/include/asm/current.h */
printk(KERN_INFO "process tty: %d\n", current->signal->tty);
Setting new values:
-------------------------------------------------------------
struct cred *creds = (struct cred *)__task_cred(current);
/* lame magic numbers */
creds->cap_permitted.cap[0] = 1024;
creds->cap_effective.cap[0] = 1024;
or
creds->cap_permitted.cap[0] = CAP_TO_MASK(CAP_NET_BIND_SERVICE); //1024;
creds->cap_effective.cap[0] = CAP_TO_MASK(CAP_NET_BIND_SERVICE); //1024;
or cap_raise() macro
cap_raise(creds->cap_permitted, CAP_NET_BIND_SERVICE);
cap_raise(creds->cap_effective, CAP_NET_BIND_SERVICE);
or cap_raise() macro with just creds->cap_effective
cap_raise(creds->cap_effective, CAP_NET_BIND_SERVICE);
// macros in: uapi/linux/capability.h
#define cap_raise(c, flag) ((c).cap[CAP_TO_INDEX(flag)] |= CAP_TO_MASK(flag))
#define cap_lower(c, flag) ((c).cap[CAP_TO_INDEX(flag)] &= ~CAP_TO_MASK(flag))
#define cap_raised(c, flag) ((c).cap[CAP_TO_INDEX(flag)] & CAP_TO_MASK(flag))
===========================================================================================================
Dangerous: Grant full capabilities for the task in a single call
/* found in some rootkits */
commit_creds(prepare_kernel_cred(0));
===========================================================================================================
include/linux/cred.h: struct cred {
[....]
kuid_t uid; /* real UID of the task */
kgid_t gid; /* real GID of the task */
kuid_t suid; /* saved UID of the task */
kgid_t sgid; /* saved GID of the task */
kuid_t euid; /* effective UID of the task */
kgid_t egid; /* effective GID of the task */
kuid_t fsuid; /* UID for VFS ops */
kgid_t fsgid; /* GID for VFS ops */
unsigned securebits; /* SUID-less security management */
kernel_cap_t cap_inheritable; /* caps our children can inherit */
kernel_cap_t cap_permitted; /* caps we're permitted */
kernel_cap_t cap_effective; /* caps we can actually use */
kernel_cap_t cap_bset; /* capability bounding set */
kernel_cap_t cap_ambient; /* Ambient capability set */
[....]
}
----------------------
struct cred *new = prepare_creds();
kernel_cap_t effective, permitted;
/*clear capabilities*/
effective.cap[0] = 0;
effective.cap[1] = 0;
permitted.cap[0] = 0;
permitted.cap[1] = 0;
new->cap_effective = effective;
new->cap_permitted = permitted;
commit_creds(new);
--------------------------------------
// example 1
struct cred *new_creds = (struct cred *)__task_cred(current);
new_creds->securebits = SECUREBITS_DEFAULT;
new_creds->cap_inheritable = CAP_EMPTY_SET;
new_creds->cap_permitted = CAP_FULL_SET;
new_creds->cap_effective = CAP_FULL_SET;
new_creds->cap_ambient = CAP_EMPTY_SET;
new_creds->cap_bset = CAP_FULL_SET;
key_put(new_creds->request_key_auth);
new_creds->request_key_auth = NULL;
new_creds->user_ns = user_ns;
// example 2
struct cred *cred = (struct cred *)__task_cred(current);
cred->uid = 0;
cred->gid = 0;
cred->suid = 0;
cred->euid = 0;
cred->euid = 0;
cred->egid = 0;
cred->fsuid = 0;
cred->fsgid = 0;
================================================================
/* lame user id check using a magic number */
struct user_namespace *user_ns = current_user_ns();
const char *user_name = "user_name";
kuid_t uuid;
/* 1000 is an existing user id */
uuid = make_kuid(user_ns, 1000);
if(uid_eq(uuid, current_uid())) {
printk(KERN_INFO "Username %s\n",user_name);
}
================================================================