fs: add O_BENEATH flag to openat(2)

Add a new O_BENEATH flag for openat(2) which restricts the
provided path, rejecting (with -EACCES) paths that are not beneath
the provided dfd.  In particular, reject:
 - paths that contain .. components
 - paths that begin with /
 - symlinks that have paths as above.

Also disallow use of nd_jump_link() for following symlinks without
path expansion, when O_BENEATH is set.

Signed-off-by: David Drysdale <drysdale@google.com>
selftests: Add test of O_BENEATH & openat(2)

Add simple tests of openat(2) variations, including examples that
check the new O_BENEATH flag.

Signed-off-by: David Drysdale <drysdale@google.com>
capsicum: rights values and structure definitions

Define (in include/uapi/linux/capsicum.h) values for primary
rights associated with Capsicum capability file descriptors.

Also define the structure that primary rights reside in (struct
cap_rights), and the complete compound rights structure (struct
capsicum_rights).

 - Primary rights describe the main operations that can be
   performed on a file.
 - Secondary rights allow for specific fcntl() and ioctl()
   operations to be policed.

Add functions to manipulate these rights structures.

This change is adapted from the FreeBSD 10.x implementation of
Capsicum, with the aim of preserving compatibility between the
two implementations as closely as possible.

Signed-off-by: David Drysdale <drysdale@google.com>
capsicum: implement fgetr() and friends

Add variants of fget() and related functions where the caller
indicates the operations that will be performed on the file.

If CONFIG_SECURITY_CAPSICUM is defined, these variants build a
struct capsicum_rights instance holding the rights associated
with the file operations; this will allow a future hook to check
whether a rights-restricted file has those specific rights
available.

If CONFIG_SECURITY_CAPSICUM is not defined, these variants expand
to the underlying fget() function, with one difference: failures
are returned as an ERR_PTR value rather than just NULL.

Signed-off-by: David Drysdale <drysdale@google.com>
capsicum: convert callers to use fgetr() etc

Convert places that use fget()-like functions to use the
equivalent fgetr() variant instead.

Annotate each such call with an indication of what operations will
be performed on the retrieved struct file, to allow future policing
of rights associated with file descriptors.

Also change each call site to cope with an ERR_PTR return from
fgetr() rather than a plain NULL failure from fget().

Signed-off-by: David Drysdale <drysdale@google.com>
capsicum: implement sockfd_lookupr()

Add variants of sockfd_lookup() and related functions where the caller
indicates the operations that will be performed on the socket.

If CONFIG_SECURITY_CAPSICUM is defined, these variants use the
fgetr()-style functions to retrieve the struct file from the file
descriptor.

If CONFIG_SECURITY_CAPSICUM is not defined, these variants use the
normal fget() functions.

Signed-off-by: David Drysdale <drysdale@google.com>
capsicum: convert callers to use sockfd_lookupr() etc

Convert places that use sockfd_lookup() functions to use the
equivalent sockfd_lookupr() variant instead.

Annotate each such call with an indication of what operations will
be performed on the retrieved socket, to allow future policing
of rights associated with file descriptors.

Signed-off-by: David Drysdale <drysdale@google.com>
capsicum: invoke Capsicum on FD/file conversion

Add calls to Capsicum to intercept FD/file conversion in the following
situations:
 - Any place where a file descriptor is converted to a struct file.
 - Any place where a new file descriptor that is derived from an
   existing file descriptor is installed into the fdtable.

For the first of these, Capsicum checks for a Capsicum capability
wrapper file and unwraps it to the underlying file, provided the
appropriate rights are available (otherwise, ERR_PTR(-ENOTCAPABLE)
is returned).

For the second, Capsicum checks whether the original file has
restricted rights associated with it.  If it does, it is replaced
with a Capsicum capability wrapper file before installation into
the fdtable.  This propagates the rights from the original FD to
the new FD, and particularly affects accept(2) and openat(2).

For openat(2) rights propagation in particular, the rights
associated with the dfd need to make their way through the code
in fs/namei.c to allow this.

The path walking code in fs/namei.c is also modified to enable
the O_BENEATH flag if the dfd is a Capsicum capability.

Signed-off-by: David Drysdale <drysdale@google.com>
capsicum: add syscalls to limit FD rights

Add the cap_rights_get(2) and cap_rights_set(2) syscalls to
allow retrieval and modification of the rights associated with
a file descriptor.

When a normal file descriptor has its rights restricted in any
way, it becomes a Capsicum capability file descriptor.  This is
a wrapper struct file that is installed in the fdtable in place
of the original file.  From this point on, when the FD is converted
to a struct file by fget() (or equivalent), the wrapper is checked
for the appropriate rights and the wrapped inner normal file is
returned.

When a Capsicum capability file descriptor has its rights restricted
further (they cannot be expanded), a new wrapper is created with
the restricted rights, also wrapping the same inner normal file.
In other words, the .underlying field in a struct capsicum_capability
is always a normal file, never another Capsicum capability file.

These syscalls specify the different components of the compound
rights structure separately, allowing components to be unspecified
for no change.

Note that in FreeBSD 10.x the function of this pair of syscalls
is implemented as 3 distinct pairs of syscalls, one pair for each
component of the compound rights (primary/fcntl/ioctl).

Signed-off-by: David Drysdale <drysdale@google.com>
capsicum: prctl(2) to force use of O_BENEATH

Add a per-task flag that indicates all openat(2) operations
should implicitly have the O_BENEATH flag set.

Add a prctl(2) command to set this flag (irrevocably). Include
an option to force the flag set to be synchronized across all
tasks in the thread group.

Signed-off-by: David Drysdale <drysdale@google.com>
seccomp: Add tgid and tid into seccomp_data

Add the current thread and thread group IDs into the data
available for seccomp-bpf programs to work on.  This allows
installation of filters that police syscalls based on thread
or process ID, e.g. tgkill(2)/kill(2)/prctl(2).

Signed-off-by: David Drysdale <drysdale@google.com>