diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,9 @@ +# Changelog + +`linux-capabilities` uses [PVP Versioning][1]. + +## 0.1.0.0 + +* Initially created. + +[1]: https://pvp.haskell.org diff --git a/LICENSE b/LICENSE new file mode 100644 --- /dev/null +++ b/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/README.md b/README.md new file mode 100644 --- /dev/null +++ b/README.md @@ -0,0 +1,8 @@ +# linux-capabilities + +[![Hackage](https://img.shields.io/hackage/v/linux-capabilities.svg?logo=haskell)](https://hackage.haskell.org/package/linux-capabilities) +[![Apache-2.0 license](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE) + +Linux capabilities Haskell data type. + +Check the [codegen.hs](./codegen.hs) script to update the source. diff --git a/codegen.hs b/codegen.hs new file mode 100644 --- /dev/null +++ b/codegen.hs @@ -0,0 +1,70 @@ +-- | A script to generate the data type +-- runhaskell codegen.hs | ormolu > src/System/Linux/Capabilities.hs +module Main (main) where + +import Data.List +import Data.Maybe + +-- | returns the list of caps with there comments +readCaps :: IO [String] +readCaps = + readFile "/usr/include/linux/capability.h" + >>= (pure . dropEnd . reverse . foldl' go []) . dropBegin . lines + where + -- The actual list starts after this line + dropBegin = drop 1 . dropWhile (not . isInfixOf "POSIX-draft defined capabilities.") + -- The list ends before this line + dropEnd = takeWhile (not . isInfixOf "CAP_LAST_CAP") + push s [] = [s] + push s (x : xs) = (x <> s <> "\n") : xs + go :: [String] -> String -> [String] + go acc s + -- Drop intermediary comment + | s == " ** Linux-specific capabilities" = acc + | "#define CAP_" `isPrefixOf` s = [""] <> push s acc + | otherwise = push s acc + +-- | create data type constructor with documentation +render :: String -> String +render = unlines . haddockPrefix . reverse . foldl' go [] . reverse . lines + where + go :: [String] -> String -> [String] + go acc s + | "#define CAP_" `isPrefixOf` s = [" " <> ((!! 1) . words $ s)] + | otherwise = case makeHaddock s of + [] -> acc + x -> acc <> [commentPrefix <> x] + commentPrefix = " -- " + haddockPrefix (x : xs) = (" -- | " <> stripPrefix' commentPrefix x) : xs + haddockPrefix [] = [] + stripPrefix' :: String -> String -> String + stripPrefix' prefix s = fromMaybe s (stripPrefix prefix s) + makeHaddock :: String -> String + makeHaddock s = + stripPrefix' " " + . stripPrefix' " ** " + . stripPrefix' " * " + . dropWhileEnd (`elem` (['*', '/', ' '] :: [Char])) + $ makeHaddockList s + makeHaddockList s + | "/* " `isPrefixOf` s = "- " <> drop 3 s + | ":" `isSuffixOf` s = s <> "\n" <> commentPrefix + | otherwise = s + +p :: String -> IO () +p = putStrLn + +main :: IO () +main = do + p "{-# LANGUAGE DerivingStrategies #-}" + p "-- |" + p "-- Copyright: (c) 2021 Red Hat" + p "-- SPDX-License-Identifier: Apache-2.0" + p "-- Maintainer: Tristan de Cacqueray " + p "--" + p "module System.Linux.Capabilities (Capability (..)) where" + p "" + p "-- | Linux capabilities" + p "data Capability = " + readCaps >>= mapM_ p . intersperse " |" . fmap render + p " deriving stock (Bounded, Enum, Eq, Read, Show)" diff --git a/linux-capabilities.cabal b/linux-capabilities.cabal new file mode 100644 --- /dev/null +++ b/linux-capabilities.cabal @@ -0,0 +1,46 @@ +cabal-version: 2.4 +name: linux-capabilities +version: 0.1.0.0 +synopsis: Linux capabilities Haskell data type +description: + linux-capabilities provides a data type and documentation for the Linux capabilities(7). + . +homepage: https://github.com/softwarefactory-project/linux-capabilities-haskell#readme +bug-reports: https://github.com/softwarefactory-project/linux-capabilities-haskell/issues +license: Apache-2.0 +license-file: LICENSE +author: Tristan de Cacqueray +maintainer: Tristan de Cacqueray +copyright: 2021 Red Hat +category: System +build-type: Simple +extra-doc-files: CHANGELOG.md + README.md +extra-source-files: codegen.hs +tested-with: GHC == 8.10.3 + +source-repository head + type: git + location: https://github.com/softwarefactory-project/linux-capabilities-haskell.git + +library + build-depends: base < 5 + ghc-options: -Wall + -Wcompat + -Widentities + -Wincomplete-uni-patterns + -Wincomplete-record-updates + if impl(ghc >= 8.0) + ghc-options: -Wredundant-constraints + if impl(ghc >= 8.2) + ghc-options: -fhide-source-paths + if impl(ghc >= 8.4) + ghc-options: -Wmissing-export-lists + -Wpartial-fields + if impl(ghc >= 8.8) + ghc-options: -Wmissing-deriving-strategies + if impl(ghc >= 8.10) + ghc-options: -Wunused-packages + default-language: Haskell2010 + hs-source-dirs: src + exposed-modules: System.Linux.Capabilities diff --git a/src/System/Linux/Capabilities.hs b/src/System/Linux/Capabilities.hs new file mode 100644 --- /dev/null +++ b/src/System/Linux/Capabilities.hs @@ -0,0 +1,205 @@ +{-# LANGUAGE DerivingStrategies #-} + +-- | +-- Copyright: (c) 2021 Red Hat +-- SPDX-License-Identifier: Apache-2.0 +-- Maintainer: Tristan de Cacqueray +module System.Linux.Capabilities (Capability (..)) where + +-- | Linux capabilities +data Capability + = -- | - In a system with the [_POSIX_CHOWN_RESTRICTED] option defined, this + -- overrides the restriction of changing file ownership and group + -- ownership. + CAP_CHOWN + | -- | - Override all DAC access, including ACL execute access if + -- [_POSIX_ACL] is defined. Excluding DAC access covered by + -- CAP_LINUX_IMMUTABLE. + CAP_DAC_OVERRIDE + | -- | - Overrides all DAC restrictions regarding read and search on files + -- and directories, including ACL restrictions if [_POSIX_ACL] is + -- defined. Excluding DAC access covered by CAP_LINUX_IMMUTABLE. + CAP_DAC_READ_SEARCH + | -- | - Overrides all restrictions about allowed operations on files, where + -- file owner ID must be equal to the user ID, except where CAP_FSETID + -- is applicable. It doesn't override MAC and DAC restrictions. + CAP_FOWNER + | -- | - Overrides the following restrictions that the effective user ID + -- shall match the file owner ID when setting the S_ISUID and S_ISGID + -- bits on that file; that the effective group ID (or one of the + -- supplementary group IDs) shall match the file owner ID when setting + -- the S_ISGID bit on that file; that the S_ISUID and S_ISGID bits are + -- cleared on successful return from chown(2) (not implemented). + CAP_FSETID + | -- | - Overrides the restriction that the real or effective user ID of a + -- process sending a signal must match the real or effective user ID + -- of the process receiving the signal. + CAP_KILL + | -- | - Allows setgid(2) manipulation + -- - Allows setgroups(2) + -- - Allows forged gids on socket credentials passing. + CAP_SETGID + | -- | - Allows set*uid(2) manipulation (including fsuid). + -- - Allows forged pids on socket credentials passing. + CAP_SETUID + | -- | - Without VFS support for capabilities: + -- Transfer any capability in your permitted set to any pid, + -- remove any capability in your permitted set from any pid + -- With VFS support for capabilities (neither of above, but) + -- Add any capability from current's capability bounding set + -- to the current process' inheritable set + -- Allow taking bits out of capability bounding set + -- Allow modification of the securebits for a process + CAP_SETPCAP + | -- | - Allow modification of S_IMMUTABLE and S_APPEND file attributes + CAP_LINUX_IMMUTABLE + | -- | - Allows binding to TCP/UDP sockets below 1024 + -- - Allows binding to ATM VCIs below 32 + CAP_NET_BIND_SERVICE + | -- | - Allow broadcasting, listen to multicast + CAP_NET_BROADCAST + | -- | - Allow interface configuration + -- - Allow administration of IP firewall, masquerading and accounting + -- - Allow setting debug option on sockets + -- - Allow modification of routing tables + -- - Allow setting arbitrary process / process group ownership on + -- sockets + -- - Allow binding to any address for transparent proxying (also via NET_RAW) + -- - Allow setting TOS (type of service) + -- - Allow setting promiscuous mode + -- - Allow clearing driver statistics + -- - Allow multicasting + -- - Allow read/write of device-specific registers + -- - Allow activation of ATM control sockets + CAP_NET_ADMIN + | -- | - Allow use of RAW sockets + -- - Allow use of PACKET sockets + -- - Allow binding to any address for transparent proxying (also via NET_ADMIN) + CAP_NET_RAW + | -- | - Allow locking of shared memory segments + -- - Allow mlock and mlockall (which doesn't really have anything to do + -- with IPC) + CAP_IPC_LOCK + | -- | - Override IPC ownership checks + CAP_IPC_OWNER + | -- | - Insert and remove kernel modules - modify kernel without limit + CAP_SYS_MODULE + | -- | - Allow ioperm/iopl access + -- - Allow sending USB messages to any device via /dev/bus/usb + CAP_SYS_RAWIO + | -- | - Allow use of chroot() + CAP_SYS_CHROOT + | -- | - Allow ptrace() of any process + CAP_SYS_PTRACE + | -- | - Allow configuration of process accounting + CAP_SYS_PACCT + | -- | - Allow configuration of the secure attention key + -- - Allow administration of the random device + -- - Allow examination and configuration of disk quotas + -- - Allow setting the domainname + -- - Allow setting the hostname + -- - Allow calling bdflush() + -- - Allow mount() and umount(), setting up new smb connection + -- - Allow some autofs root ioctls + -- - Allow nfsservctl + -- - Allow VM86_REQUEST_IRQ + -- - Allow to read/write pci config on alpha + -- - Allow irix_prctl on mips (setstacksize) + -- - Allow flushing all cache on m68k (sys_cacheflush) + -- - Allow removing semaphores + -- - Used instead of CAP_CHOWN to "chown" IPC message queues, semaphores + -- and shared memory + -- - Allow locking/unlocking of shared memory segment + -- - Allow turning swap on/off + -- - Allow forged pids on socket credentials passing + -- - Allow setting readahead and flushing buffers on block devices + -- - Allow setting geometry in floppy driver + -- - Allow turning DMA on/off in xd driver + -- - Allow administration of md devices (mostly the above, but some + -- extra ioctls) + -- - Allow tuning the ide driver + -- - Allow access to the nvram device + -- - Allow administration of apm_bios, serial and bttv (TV) device + -- - Allow manufacturer commands in isdn CAPI support driver + -- - Allow reading non-standardized portions of pci configuration space + -- - Allow DDI debug ioctl on sbpcd driver + -- - Allow setting up serial ports + -- - Allow sending raw qic-117 commands + -- - Allow enabling/disabling tagged queuing on SCSI controllers and sending + -- arbitrary SCSI commands + -- - Allow setting encryption key on loopback filesystem + -- - Allow setting zone reclaim policy + -- - Allow everything under CAP_BPF and CAP_PERFMON for backward compatibility + CAP_SYS_ADMIN + | -- | - Allow use of reboot() + CAP_SYS_BOOT + | -- | - Allow raising priority and setting priority on other (different + -- UID) processes + -- - Allow use of FIFO and round-robin (realtime) scheduling on own + -- processes and setting the scheduling algorithm used by another + -- process. + -- - Allow setting cpu affinity on other processes + -- - Allow setting realtime ioprio class + -- - Allow setting ioprio class on other processes + CAP_SYS_NICE + | -- | - Override resource limits. Set resource limits. + -- - Override quota limits. + -- - Override reserved space on ext2 filesystem + -- - Modify data journaling mode on ext3 filesystem (uses journaling + -- resources) + -- - NOTE: ext2 honors fsuid when checking for resource overrides, so + -- you can override using fsuid too + -- - Override size restrictions on IPC message queues + -- - Allow more than 64hz interrupts from the real-time clock + -- - Override max number of consoles on console allocation + -- - Override max number of keymaps + -- - Control memory reclaim behavior + CAP_SYS_RESOURCE + | -- | - Allow manipulation of system clock + -- - Allow irix_stime on mips + -- - Allow setting the real-time clock + CAP_SYS_TIME + | -- | - Allow configuration of tty devices + -- - Allow vhangup() of tty + CAP_SYS_TTY_CONFIG + | -- | - Allow the privileged aspects of mknod() + CAP_MKNOD + | -- | - Allow taking of leases on files + CAP_LEASE + | -- | - Allow writing the audit log via unicast netlink socket + CAP_AUDIT_WRITE + | -- | - Allow configuration of audit via unicast netlink socket + CAP_AUDIT_CONTROL + | -- | - Set or remove capabilities on files + CAP_SETFCAP + | -- | - Override MAC access. + -- The base kernel enforces no MAC policy. + -- An LSM may enforce a MAC policy, and if it does and it chooses + -- to implement capability based overrides of that policy, this is + -- the capability it should use to do so. + CAP_MAC_OVERRIDE + | -- | - Allow MAC configuration or state changes. + -- The base kernel requires no MAC configuration. + -- An LSM may enforce a MAC policy, and if it does and it chooses + -- to implement capability based checks on modifications to that + -- policy or the data required to maintain it, this is the + -- capability it should use to do so. + CAP_MAC_ADMIN + | -- | - Allow configuring the kernel's syslog (printk behaviour) + CAP_SYSLOG + | -- | - Allow triggering something that will wake the system + CAP_WAKE_ALARM + | -- | - Allow preventing system suspends + CAP_BLOCK_SUSPEND + | -- | - Allow reading the audit log via multicast netlink socket + CAP_AUDIT_READ + | -- | - Allow system performance and observability privileged operations + -- using perf_events, i915_perf and other kernel subsystems + CAP_PERFMON + | -- | - CAP_BPF allows BPF operations + CAP_BPF + | -- | - Allow checkpoint/restore related operations + -- - Allow PID selection during clone3() + -- - Allow writing to ns_last_pid + CAP_CHECKPOINT_RESTORE + deriving stock (Bounded, Enum, Eq, Read, Show)