[RFC PATCH] security: Allow dropping bounding set process-wide

[Jinjie Ruan <ruanjinjie@huawei.com>]

The capability bounding set is per-thread: PR_CAPBSET_DROP only affects
the calling thread, since its bounding set lives in the per-task struct
cred.  User space that wants to drop capabilities for a whole process
must therefore invoke PR_CAPBSET_DROP once per capability per thread,
which on a many-threaded process is expensive, and from a Go runtime
requires stopping the world and signalling every thread.

Add PR_CAPBSET_DROP_MASK, an opt-in prctl that removes a set of
capabilities, given as a 64-bit mask in arg2 (low 32 bits) and arg3
(high 32 bits), from the bounding set of every thread of the calling
thread group in a single call.

The calling thread drops the capabilities synchronously, last; every
sibling that still holds any of them is asked to drop them through a
task_work item, so that it applies the drop in its own context.  This
avoids racing with a sibling's concurrent credential updates such as
setuid() or capset().  The call does not wait for the siblings: a
sibling may be parked in a wait that is not woken by TIF_NOTIFY_SIGNAL
(e.g. futex), so waiting could block for an unbounded time.  This is
still safe, because TIF_NOTIFY_SIGNAL is handled on the way out to user
mode, so a sibling applies the drop before executing any further
userspace code.  It does not synchronize against a sibling that is
concurrently creating threads, so callers must keep the thread group
quiescent while dropping.

Measured with gVisor's "bounding set trimmed" boot phase on an arm64 KVM
guest (medians over repeated boots):
  - 8 vCPUs:  ~1.6ms  -> ~0.10ms
  - 32 vCPUs: ~3.5ms  -> ~0.11ms
  - 64 vCPUs: ~10.1ms -> ~0.1-0.6ms
  - cost goes from O(capabilities * threads) stop-the-world prctls to a
    single thread-group walk.

Cc: Serge Hallyn <serge@hallyn.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: James Morris <jmorris@namei.org>
Cc: Paul Walmsley <pjw@kernel.org>
Cc: Thomas Gleixner <tglx@kernel.org>
Cc: Zong Li <zong.li@sifive.com>
Cc: Deepak Gupta <debug@rivosinc.com>
Cc: "Peter Zijlstra (Intel)" <peterz@infradead.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
---
 include/uapi/linux/prctl.h |   1 +
 security/commoncap.c       | 129 +++++++++++++++++++++++++++++++++++++
 2 files changed, 130 insertions(+)

diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h
index b6ec6f693719..750a7824d3bc 100644
--- a/include/uapi/linux/prctl.h
+++ b/include/uapi/linux/prctl.h
@@ -70,6 +70,7 @@
 /* Get/set the capability bounding set (as per security/commoncap.c) */
 #define PR_CAPBSET_READ 23
 #define PR_CAPBSET_DROP 24
+#define PR_CAPBSET_DROP_MASK 83
 
 /* Get/set the process' ability to use the timestamp counter instruction */
 #define PR_GET_TSC 25
diff --git a/security/commoncap.c b/security/commoncap.c
index 3399535808fe..ae7ce50a8151 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -19,7 +19,14 @@
 #include <linux/hugetlb.h>
 #include <linux/mount.h>
 #include <linux/sched.h>
+#include <linux/cred.h>
+#include <linux/rcupdate.h>
+#include <linux/sched/signal.h>
+#include <linux/sched/task.h>
+#include <linux/slab.h>
+#include <linux/task_work.h>
 #include <linux/prctl.h>
+#include <linux/printk.h>
 #include <linux/securebits.h>
 #include <linux/user_namespace.h>
 #include <linux/binfmts.h>
@@ -1283,6 +1290,123 @@ static int cap_prctl_drop(unsigned long cap)
 	return commit_creds(new);
 }
 
+/*
+ * Structure used to queue process-wide bounding set drops via task_work.
+ */
+struct cap_bset_drop_work {
+	struct callback_head work;
+	struct task_struct *task;
+	kernel_cap_t mask;
+	struct cap_bset_drop_work *next;
+};
+
+static void cap_bset_drop_work_fn(struct callback_head *work)
+{
+	struct cap_bset_drop_work *w = container_of(work, struct cap_bset_drop_work, work);
+	struct cred *new = prepare_creds();
+
+	if (!new) {
+		/* Out of memory: bounding set drop failed silently for this thread. */
+		pr_warn_ratelimited("capability bounding set drop failed for pid %d (%s)\n",
+				    task_pid_nr(current), current->comm);
+		goto out;
+	}
+
+	new->cap_bset = cap_drop(new->cap_bset, w->mask);
+	commit_creds(new);
+
+out:
+	put_task_struct(w->task);
+	kfree(w);
+}
+
+/*
+ * cap_bset_drop_process - Drop capabilities from all threads in the group.
+ * @mask: Mask of capabilities to drop from the bounding set.
+ *
+ * Drops @mask from the calling thread synchronously, and queues a task_work
+ * item for each sibling thread to safely apply the drop in its own context.
+ *
+ * The caller must hold CAP_SETPCAP. Thread group must be quiescent to avoid
+ * racing with concurrent thread creation.
+ *
+ * Returns 0 on success, or -ENOMEM if allocations fail (all-or-nothing).
+ */
+static int cap_bset_drop_process(kernel_cap_t mask)
+{
+	struct cap_bset_drop_work *list = NULL, *w, *next;
+	struct task_struct *thread;
+	struct cred *new = NULL;
+	int ret = 0;
+
+	rcu_read_lock();
+	for_each_thread(current, thread) {
+		const struct cred *cred;
+
+		if (thread == current || (thread->flags & PF_EXITING))
+			continue;
+
+		cred = __task_cred(thread);
+		if (cap_isclear(cap_intersect(cred->cap_bset, mask)))
+			continue;
+
+		w = kmalloc_obj(*w, GFP_ATOMIC);
+		if (!w) {
+			ret = -ENOMEM;
+			break;
+		}
+
+		w->task = get_task_struct(thread);
+		w->mask = mask;
+		w->next = list;
+		list = w;
+	}
+	rcu_read_unlock();
+
+	if (!ret) {
+		new = prepare_creds();
+		if (!new)
+			ret = -ENOMEM;
+	}
+
+	if (ret) {
+		while (list) {
+			next = list->next;
+			put_task_struct(list->task);
+			kfree(list);
+			list = next;
+		}
+		return ret;
+	}
+
+	for (w = list; w; w = next) {
+		next = w->next;
+		init_task_work(&w->work, cap_bset_drop_work_fn);
+		if (task_work_add(w->task, &w->work, TWA_SIGNAL)) {
+			put_task_struct(w->task);
+			kfree(w);
+		}
+	}
+
+	new->cap_bset = cap_drop(new->cap_bset, mask);
+	commit_creds(new);
+
+	return 0;
+}
+
+static int cap_prctl_drop_mask(unsigned long low, unsigned long high)
+{
+	kernel_cap_t mask = mk_kernel_cap((u32)low, (u32)high);
+
+	if (cap_isclear(mask))
+		return 0;
+
+	if (!ns_capable(current_user_ns(), CAP_SETPCAP))
+		return -EPERM;
+
+	return cap_bset_drop_process(mask);
+}
+
 /**
  * cap_task_prctl - Implement process control functions for this security module
  * @option: The process control function requested
@@ -1313,6 +1437,11 @@ int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
 	case PR_CAPBSET_DROP:
 		return cap_prctl_drop(arg2);
 
+	case PR_CAPBSET_DROP_MASK:
+		if (arg4 || arg5)
+			return -EINVAL;
+		return cap_prctl_drop_mask(arg2, arg3);
+
 	/*
 	 * The next four prctl's remain to assist with transitioning a
 	 * system from legacy UID=0 based privilege (when filesystem
-- 
2.34.1