libcap/cap_proc.c - master - auroraos/mirror_libcap

libcap/cap_proc.c
1 145 строк28 KB
Sayed Kaif
cap_proc: use 32-bit-clean setuid/setgid syscalls in the psx path
17 июн 2026, 16:55
17 июн 2026, 16:5527e899d
/*
 * Copyright (c) 1997-8,2007,11,19-21 Andrew G Morgan <morgan@kernel.org>
 *
 * This file deals with getting and setting capabilities on processes.
 */

#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif

#include <errno.h>
#include <fcntl.h>              /* Obtain O_* constant definitions */
#include <grp.h>
#include <sys/prctl.h>
#include <sys/securebits.h>
#include <sys/syscall.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>

#include "libcap.h"

/*
 * libcap uses this abstraction for all system calls that change
 * kernel managed capability state. This permits the user to redirect
 * it for testing and also to better implement posix semantics when
 * using pthreads.
 */

static long int _cap_syscall3(long int syscall_nr,
			      long int arg1, long int arg2, long int arg3)
{
    return syscall(syscall_nr, arg1, arg2, arg3);
}

static long int _cap_syscall6(long int syscall_nr,
			      long int arg1, long int arg2, long int arg3,
			      long int arg4, long int arg5, long int arg6)
{
    return syscall(syscall_nr, arg1, arg2, arg3, arg4, arg5, arg6);
}

/*
 * to keep the structure of the code conceptually similar in C and Go
 * implementations, we introduce this abstraction for invoking state
 * writing system calls. In psx+pthreaded code, the fork
 * implementation provided by nptl ensures that we can consistently
 * use the multithreaded syscalls even in the child after a fork().
 */
struct syscaller_s {
    long int (*three)(long int syscall_nr,
		      long int arg1, long int arg2, long int arg3);
    long int (*six)(long int syscall_nr,
		    long int arg1, long int arg2, long int arg3,
		    long int arg4, long int arg5, long int arg6);
};

/* use this syscaller for multi-threaded code */
static struct syscaller_s multithread = {
    .three = _cap_syscall3,
    .six = _cap_syscall6
};

/* use this syscaller for single-threaded code */
static struct syscaller_s singlethread = {
    .three = _cap_syscall3,
    .six = _cap_syscall6
};

/*
 * This gets reset to 0 if we are *not* linked with libpsx.
 */
__attribute__((visibility ("hidden"))) int _libcap_overrode_syscalls = 1;

/*
 * cap_set_syscall overrides the state setting syscalls that libcap does.
 * Generally, you don't need to call this manually: libcap tries hard to
 * set things up appropriately.
 */
void cap_set_syscall(long int (*new_syscall)(long int,
					     long int, long int, long int),
			    long int (*new_syscall6)(long int, long int,
						     long int, long int,
						     long int, long int,
						     long int)) {
    if (new_syscall == NULL) {
	psx_load_syscalls(&multithread.three, &multithread.six);
    } else {
	multithread.three = new_syscall;
	multithread.six = new_syscall6;
    }
}

static int _libcap_capset(struct syscaller_s *sc,
			  cap_user_header_t header, const cap_user_data_t data)
{
    if (_libcap_overrode_syscalls) {
	return sc->three(SYS_capset, (long int) header, (long int) data, 0);
    }
    return capset(header, data);
}

static int _libcap_wprctl3(struct syscaller_s *sc,
			   long int pr_cmd, long int arg1, long int arg2)
{
    if (_libcap_overrode_syscalls) {
	int result;
	result = sc->three(SYS_prctl, pr_cmd, arg1, arg2);
	if (result >= 0) {
	    return result;
	}
	errno = -result;
	return -1;
    }
    return prctl(pr_cmd, arg1, arg2, 0, 0, 0);
}

static int _libcap_wprctl6(struct syscaller_s *sc,
			   long int pr_cmd, long int arg1, long int arg2,
			   long int arg3, long int arg4, long int arg5)
{
    if (_libcap_overrode_syscalls) {
	int result;
	result = sc->six(SYS_prctl, pr_cmd, arg1, arg2, arg3, arg4, arg5);
	if (result >= 0) {
	    return result;
	}
	errno = -result;
	return -1;
    }
    return prctl(pr_cmd, arg1, arg2, arg3, arg4, arg5);
}

/*
 * cap_get_proc obtains the capability set for the current process.
 */
cap_t cap_get_proc(void)
{
    cap_t result;

    /* allocate a new capability set */
    result = cap_init();
    if (result) {
	_cap_debug("getting current process' capabilities");

	/* fill the capability sets via a system call */
	if (capget(&result->head, &result->u[0].set)) {
	    cap_free(result);
	    result = NULL;
	}
    }

    return result;
}

static int _cap_set_proc(struct syscaller_s *sc, cap_t cap_d) {
    int retval;

    if (!good_cap_t(cap_d)) {
	errno = EINVAL;
	return -1;
    }

    _cap_debug("setting process capabilities");
    _cap_mu_lock(&cap_d->mutex);
    retval = _libcap_capset(sc, &cap_d->head, &cap_d->u[0].set);
    _cap_mu_unlock(&cap_d->mutex);

    return retval;
}

int cap_set_proc(cap_t cap_d)
{
    return _cap_set_proc(&multithread, cap_d);
}

/* the following two functions are not required by POSIX */

/* read the caps on a specific process */

int capgetp(pid_t pid, cap_t cap_d)
{
    int error;

    if (!good_cap_t(cap_d)) {
	errno = EINVAL;
	return -1;
    }

    _cap_debug("getting process capabilities for proc %d", pid);

    _cap_mu_lock(&cap_d->mutex);
    cap_d->head.pid = pid;
    error = capget(&cap_d->head, &cap_d->u[0].set);
    cap_d->head.pid = 0;
    _cap_mu_unlock(&cap_d->mutex);

    return error;
}

/* allocate space for and return capabilities of target process */

cap_t cap_get_pid(pid_t pid)
{
    cap_t result;

    result = cap_init();
    if (result) {
	if (capgetp(pid, result) != 0) {
	    int my_errno;

	    my_errno = errno;
	    cap_free(result);
	    errno = my_errno;
	    result = NULL;
	}
    }

    return result;
}

/*
 * set the caps on a specific process/pg etc.. The kernel has long
 * since deprecated this asynchronous interface. DON'T EXPECT THIS TO
 * EVER WORK AGAIN.
 */

int capsetp(pid_t pid, cap_t cap_d)
{
    int error;

    if (!good_cap_t(cap_d)) {
	errno = EINVAL;
	return -1;
    }

    _cap_debug("setting process capabilities for proc %d", pid);
    _cap_mu_lock(&cap_d->mutex);
    cap_d->head.pid = pid;
    error = capset(&cap_d->head, &cap_d->u[0].set);
    cap_d->head.version = _LIBCAP_CAPABILITY_VERSION;
    cap_d->head.pid = 0;
    _cap_mu_unlock(&cap_d->mutex);

    return error;
}

/* the kernel api requires unsigned long arguments */
#define pr_arg(x) ((unsigned long) x)

/* get a capability from the bounding set */

int cap_get_bound(cap_value_t cap)
{
    return prctl(PR_CAPBSET_READ, pr_arg(cap), pr_arg(0));
}

static int _cap_drop_bound(struct syscaller_s *sc, cap_value_t cap)
{
    return _libcap_wprctl3(sc, PR_CAPBSET_DROP, pr_arg(cap), pr_arg(0));
}

/* drop a capability from the bounding set */

int cap_drop_bound(cap_value_t cap) {
    return _cap_drop_bound(&multithread, cap);
}

/* get a capability from the ambient set */

int cap_get_ambient(cap_value_t cap)
{
    int result;
    result = prctl(PR_CAP_AMBIENT, pr_arg(PR_CAP_AMBIENT_IS_SET),
		   pr_arg(cap), pr_arg(0), pr_arg(0));
    if (result < 0) {
	errno = -result;
	return -1;
    }
    return result;
}

static int _cap_set_ambient(struct syscaller_s *sc,
			    cap_value_t cap, cap_flag_value_t set)
{
    int val;
    switch (set) {
    case CAP_SET:
	val = PR_CAP_AMBIENT_RAISE;
	break;
    case CAP_CLEAR:
	val = PR_CAP_AMBIENT_LOWER;
	break;
    default:
	errno = EINVAL;
	return -1;
    }
    return _libcap_wprctl6(sc, PR_CAP_AMBIENT, pr_arg(val), pr_arg(cap),
			   pr_arg(0), pr_arg(0), pr_arg(0));
}

/*
 * cap_set_ambient modifies a single ambient capability value.
 */
int cap_set_ambient(cap_value_t cap, cap_flag_value_t set)
{
    return _cap_set_ambient(&multithread, cap, set);
}

static int _cap_reset_ambient(struct syscaller_s *sc)
{
    int olderrno = errno;
    cap_value_t c;
    int result = 0;

    for (c = 0; !result; c++) {
	result = cap_get_ambient(c);
	if (result == -1) {
	    errno = olderrno;
	    return 0;
	}
    }

    return _libcap_wprctl6(sc, PR_CAP_AMBIENT,
			   pr_arg(PR_CAP_AMBIENT_CLEAR_ALL),
			   pr_arg(0), pr_arg(0), pr_arg(0), pr_arg(0));
}

/*
 * cap_reset_ambient erases all ambient capabilities - this reads the
 * ambient caps before performing the erase to workaround the corner
 * case where the set is empty already but the ambient cap API is
 * locked.
 */
int cap_reset_ambient(void)
{
    return _cap_reset_ambient(&multithread);
}

/*
 * Read the security mode of the current process.
 */
unsigned cap_get_secbits(void)
{
    return (unsigned) prctl(PR_GET_SECUREBITS, pr_arg(0), pr_arg(0));
}

static int _cap_set_secbits(struct syscaller_s *sc, unsigned bits)
{
    return _libcap_wprctl3(sc, PR_SET_SECUREBITS, bits, 0);
}

/*
 * Set the secbits of the current process.
 */
int cap_set_secbits(unsigned bits)
{
    return _cap_set_secbits(&multithread, bits);
}

/*
 * Attempt to raise the no new privs prctl value.
 */
static void _cap_set_no_new_privs(struct syscaller_s *sc)
{
    (void) _libcap_wprctl6(sc, PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0, 0);
}

/*
 * cap_prctl performs a prctl() 6 argument call on the current
 * thread. Use cap_prctlw() if you want to perform a POSIX semantics
 * prctl() system call.
 */
int cap_prctl(long int pr_cmd, long int arg1, long int arg2,
	      long int arg3, long int arg4, long int arg5)
{
    return prctl(pr_cmd, arg1, arg2, arg3, arg4, arg5);
}

/*
 * cap_prctlw performs a POSIX semantics prctl() call. That is a 6 arg
 * prctl() call that executes on all available threads when libpsx is
 * linked. The suffix 'w' refers to the fact one only ever needs to
 * invoke this is if the call will write some kernel state.
 */
int cap_prctlw(long int pr_cmd, long int arg1, long int arg2,
	       long int arg3, long int arg4, long int arg5)
{
    return _libcap_wprctl6(&multithread, pr_cmd, arg1, arg2, arg3, arg4, arg5);
}

/*
 * Some predefined constants
 */
#define CAP_SECURED_BITS_BASIC                                 \
    (SECBIT_NOROOT | SECBIT_NOROOT_LOCKED |                    \
     SECBIT_NO_SETUID_FIXUP | SECBIT_NO_SETUID_FIXUP_LOCKED |  \
     SECBIT_KEEP_CAPS_LOCKED)

#define CAP_SECURED_BITS_AMBIENT  (CAP_SECURED_BITS_BASIC |    \
     SECBIT_NO_CAP_AMBIENT_RAISE | SECBIT_NO_CAP_AMBIENT_RAISE_LOCKED)

static cap_value_t raise_cap_setpcap[] = {CAP_SETPCAP};

static int _cap_set_mode(struct syscaller_s *sc, cap_mode_t flavor)
{
    int ret;
    unsigned secbits = CAP_SECURED_BITS_AMBIENT;
    cap_t working = cap_get_proc();

    if (working == NULL) {
	_cap_debug("getting current process' capabilities failed");
	return -1;
    }

    ret = cap_set_flag(working, CAP_EFFECTIVE, 1, raise_cap_setpcap, CAP_SET) |
	_cap_set_proc(sc, working);
    if (ret == 0) {
	cap_flag_t c;

	switch (flavor) {
	case CAP_MODE_NOPRIV:
	    /* fall through */
	case CAP_MODE_PURE1E_INIT:
	    (void) cap_clear_flag(working, CAP_INHERITABLE);
	    /* fall through */
	case CAP_MODE_PURE1E:
	    if (!CAP_AMBIENT_SUPPORTED()) {
		secbits = CAP_SECURED_BITS_BASIC;
	    } else {
		ret = _cap_reset_ambient(sc);
		if (ret) {
		    break; /* ambient dropping failed */
		}
	    }
	    ret = _cap_set_secbits(sc, secbits);
	    if (flavor != CAP_MODE_NOPRIV) {
		break;
	    }

	    /* just for "case CAP_MODE_NOPRIV:" */

	    for (c = 0; cap_get_bound(c) >= 0; c++) {
		(void) _cap_drop_bound(sc, c);
	    }
	    (void) cap_clear_flag(working, CAP_PERMITTED);

	    /* for good measure */
	    _cap_set_no_new_privs(sc);
	    break;
	case CAP_MODE_HYBRID:
	    ret = _cap_set_secbits(sc, 0);
	    break;
	default:
	    errno = EINVAL;
	    ret = -1;
	    break;
	}
    }

    (void) cap_clear_flag(working, CAP_EFFECTIVE);
    ret = _cap_set_proc(sc, working) | ret;
    (void) cap_free(working);
    return ret;
}

/*
 * cap_set_mode locks the overarching capability framework of the
 * present process and thus its children to a predefined flavor. Once
 * set, these modes cannot be undone by the affected process tree and
 * can only be done by "cap_setpcap" permitted processes. Note, a side
 * effect of this function, whether it succeeds or fails, is to clear
 * at least the CAP_EFFECTIVE flags for the current process.
 */
int cap_set_mode(cap_mode_t flavor)
{
    return _cap_set_mode(&multithread, flavor);
}

/*
 * cap_get_mode attempts to determine what the current capability mode
 * is. If it can find no match in the libcap pre-defined modes, it
 * returns CAP_MODE_UNCERTAIN.
 */
cap_mode_t cap_get_mode(void)
{
    unsigned secbits = cap_get_secbits();

    if (secbits == 0) {
	return CAP_MODE_HYBRID;
    }
    if ((secbits & CAP_SECURED_BITS_BASIC) != CAP_SECURED_BITS_BASIC) {
	return CAP_MODE_UNCERTAIN;
    }

    /* validate ambient is not set */
    int olderrno = errno;
    int ret = 0, cf;
    cap_value_t c;
    for (c = 0; !ret; c++) {
	ret = cap_get_ambient(c);
	if (ret == -1) {
	    errno = olderrno;
	    if (c && secbits != CAP_SECURED_BITS_AMBIENT) {
		return CAP_MODE_UNCERTAIN;
	    }
	    ret = 0;
	    break;
	}
	if (ret) {
	    return CAP_MODE_UNCERTAIN;
	}
    }

    /*
     * Explore how capabilities differ from empty.
     */
    cap_t working = cap_get_proc();
    cap_t empty = cap_init();
    if (working == NULL || empty == NULL) {
	_cap_debug("working=%p, empty=%p - need both non-NULL", working, empty);
	ret = -1;
    } else {
	cf = cap_compare(empty, working);
    }
    cap_free(empty);
    cap_free(working);
    if (ret != 0) {
	return CAP_MODE_UNCERTAIN;
    }

    if (CAP_DIFFERS(cf, CAP_INHERITABLE)) {
	return CAP_MODE_PURE1E;
    }
    if (CAP_DIFFERS(cf, CAP_PERMITTED) || CAP_DIFFERS(cf, CAP_EFFECTIVE)) {
	return CAP_MODE_PURE1E_INIT;
    }

    for (c = 0; ; c++) {
	int v = cap_get_bound(c);
	if (v == -1) {
	    break;
	}
	if (v) {
	    return CAP_MODE_PURE1E_INIT;
	}
    }

    return CAP_MODE_NOPRIV;
}

/*
 * Changing the uid/gid of a process must use the 32-bit-clean system
 * calls. On 32-bit architectures that predate the Linux 2.4 uid_t/gid_t
 * widening (i386, arm, ...), the bare SYS_setuid/SYS_setgid/SYS_setgroups
 * numbers refer to the legacy system calls that operate on a 16-bit
 * identifier and *silently truncate* any value that does not fit. The
 * glibc setuid()/setgid()/setgroups() wrappers avoid this by issuing the
 * *32 variants, but the psx syscall path that libcap uses to perform a
 * (POSIX semantics, all-threads) credential change bypasses glibc, so we
 * must select the wide variants ourselves. Getting this wrong is a
 * security problem rather than a mere portability nit: e.g. an attempt to
 * drop privilege to uid 0x10000 would be truncated to uid 0, leaving the
 * process running as root.
 */
#if defined(__arm__) || defined(__i386__) || \
    defined(__i486__) || defined(__i586__) || defined(__i686__)
#define sys_setuid_variant     SYS_setuid32
#define sys_setgid_variant     SYS_setgid32
#define sys_setgroups_variant  SYS_setgroups32
#else
#define sys_setuid_variant     SYS_setuid
#define sys_setgid_variant     SYS_setgid
#define sys_setgroups_variant  SYS_setgroups
#endif

/*
 * Whenever the kernel exposes the legacy 16-bit credential system calls
 * it also exposes the 32-bit-clean *32 variants. Assert at build time
 * that we never regress to a truncating variant on such architectures.
 */
#ifdef SYS_setuid32
libcap_static_assert(sys_setuid_variant == SYS_setuid32,
		     setuid_syscall_must_be_32bit_clean);
#endif
#ifdef SYS_setgid32
libcap_static_assert(sys_setgid_variant == SYS_setgid32,
		     setgid_syscall_must_be_32bit_clean);
#endif
#ifdef SYS_setgroups32
libcap_static_assert(sys_setgroups_variant == SYS_setgroups32,
		     setgroups_syscall_must_be_32bit_clean);
#endif

static int _cap_setuid(struct syscaller_s *sc, uid_t uid)
{
    const cap_value_t raise_cap_setuid[] = {CAP_SETUID};
    cap_t working = cap_get_proc();
    if (working == NULL) {
	return -1;
    }

    (void) cap_set_flag(working, CAP_EFFECTIVE,
			1, raise_cap_setuid, CAP_SET);
    /*
     * Note, we are cognizant of not using glibc's setuid in the case
     * that we've modified the way libcap is doing setting
     * syscalls. This is because prctl needs to be working in a POSIX
     * compliant way for the code below to work, so we are either
     * all-broken or not-broken and don't allow for "sort of working".
     */
    (void) _libcap_wprctl3(sc, PR_SET_KEEPCAPS, 1, 0);
    int ret = _cap_set_proc(sc, working);
    if (ret == 0) {
	if (_libcap_overrode_syscalls) {
	    ret = sc->three(sys_setuid_variant, (long int) uid, 0, 0);
	    if (ret < 0) {
		errno = -ret;
		ret = -1;
	    }
	} else {
	    ret = setuid(uid);
	}
    }
    int olderrno = errno;
    (void) _libcap_wprctl3(sc, PR_SET_KEEPCAPS, 0, 0);
    (void) cap_clear_flag(working, CAP_EFFECTIVE);
    (void) _cap_set_proc(sc, working);
    (void) cap_free(working);

    errno = olderrno;
    return ret;
}

/*
 * cap_setuid attempts to set the uid of the process without dropping
 * any permitted capabilities in the process. A side effect of a call
 * to this function is that the effective set will be cleared by the
 * time the function returns.
 */
int cap_setuid(uid_t uid)
{
    return _cap_setuid(&multithread, uid);
}

static int _cap_setgroups(struct syscaller_s *sc,
			  gid_t gid, size_t ngroups, const gid_t groups[])
{
    const cap_value_t raise_cap_setgid[] = {CAP_SETGID};
    cap_t working = cap_get_proc();
    if (working == NULL) {
	return -1;
    }

    (void) cap_set_flag(working, CAP_EFFECTIVE,
			1, raise_cap_setgid, CAP_SET);
    /*
     * Note, we are cognizant of not using glibc's setgid etc in the
     * case that we've modified the way libcap is doing setting
     * syscalls. This is because prctl needs to be working in a POSIX
     * compliant way for the other functions of this file so we are
     * all-broken or not-broken and don't allow for "sort of working".
     */
    int ret = _cap_set_proc(sc, working);
    if (_libcap_overrode_syscalls) {
	if (ret == 0) {
	    ret = sc->three(sys_setgid_variant, (long int) gid, 0, 0);
	}
	if (ret == 0) {
	    ret = sc->three(sys_setgroups_variant, (long int) ngroups,
			    (long int) groups, 0);
	}
	if (ret < 0) {
	    errno = -ret;
	    ret = -1;
	}
    } else {
	if (ret == 0) {
	    ret = setgid(gid);
	}
	if (ret == 0) {
	    ret = setgroups(ngroups, groups);
	}
    }
    int olderrno = errno;

    (void) cap_clear_flag(working, CAP_EFFECTIVE);
    (void) _cap_set_proc(sc, working);
    (void) cap_free(working);

    errno = olderrno;
    return ret;
}

/*
 * cap_setgroups combines setting the gid with changing the set of
 * supplemental groups for a user into one call that raises the needed
 * capabilities to do it for the duration of the call. A side effect
 * of a call to this function is that the effective set will be
 * cleared by the time the function returns.
 */
int cap_setgroups(gid_t gid, size_t ngroups, const gid_t groups[])
{
    return _cap_setgroups(&multithread, gid, ngroups, groups);
}

/*
 * cap_iab_get_proc returns a cap_iab_t value initialized by the
 * current process state related to these iab bits.
 */
cap_iab_t cap_iab_get_proc(void)
{
    cap_iab_t iab;
    cap_t current;

    iab = cap_iab_init();
    if (iab == NULL) {
	_cap_debug("no memory for IAB tuple");
	return NULL;
    }

    current = cap_get_proc();
    if (current == NULL) {
	_cap_debug("no memory for cap_t");
	cap_free(iab);
	return NULL;
    }

    cap_iab_fill(iab, CAP_IAB_INH, current, CAP_INHERITABLE);
    cap_free(current);

    cap_value_t c;
    for (c = cap_max_bits(); c; ) {
	--c;
	int o = c >> 5;
	__u32 mask = 1U << (c & 31);
	if (cap_get_bound(c) == 0) {
	    iab->nb[o] |= mask;
	}
	if (cap_get_ambient(c) == 1) {
	    iab->a[o] |= mask;
	}
    }
    return iab;
}

/*
 * _cap_iab_set_proc sets the iab collection using the requested
 * syscaller.  The iab value is locked by the caller. Note, if needed,
 * CAP_SETPCAP will be raised in the Effective flag of the process
 * internally to the function for the duration of the function call.
 */
static int _cap_iab_set_proc(struct syscaller_s *sc, cap_iab_t iab)
{
    int ret, i, raising = 0, check_bound = 0;
    cap_value_t c;
    cap_t working, temp = cap_get_proc();

    if (temp == NULL) {
	return -1;
    }

    for (i = 0; i < _LIBCAP_CAPABILITY_U32S; i++) {
	__u32 newI = iab->i[i];
	__u32 oldIP = temp->u[i].flat[CAP_INHERITABLE] |
	    temp->u[i].flat[CAP_PERMITTED];
	raising |= newI & ~oldIP;
	if (iab->nb[i]) {
	    check_bound = 1;
	}
	temp->u[i].flat[CAP_INHERITABLE] = newI;
    }

    if (check_bound) {
	check_bound = 0;
	for (c = cap_max_bits(); c-- != 0; ) {
	    unsigned offset = c >> 5;
	    __u32 mask = 1U << (c & 31);
	    if ((iab->nb[offset] & mask) && cap_get_bound(c)) {
		/* Requesting a change of bounding set. */
		raising = 1;
		check_bound = 1;
		break;
	    }
	}
    }

    working = cap_dup(temp);
    if (working == NULL) {
	ret = -1;
	goto defer;
    }
    if (raising) {
	ret = cap_set_flag(working, CAP_EFFECTIVE,
			   1, raise_cap_setpcap, CAP_SET);
	if (ret) {
	    goto defer;
	}
    }
    if ((ret = _cap_set_proc(sc, working))) {
	goto defer;
    }
    if ((ret = _cap_reset_ambient(sc))) {
	goto done;
    }

    for (c = cap_max_bits(); c-- != 0; ) {
	unsigned offset = c >> 5;
	__u32 mask = 1U << (c & 31);
	if (iab->a[offset] & mask) {
	    ret = _cap_set_ambient(sc, c, CAP_SET);
	    if (ret) {
		goto done;
	    }
	}
	if (check_bound && (iab->nb[offset] & mask)) {
	    /* drop the bounding bit */
	    ret = _cap_drop_bound(sc, c);
	    if (ret) {
		goto done;
	    }
	}
    }

done:
    (void) cap_set_proc(temp);

defer:
    cap_free(working);
    cap_free(temp);

    return ret;
}

/*
 * cap_iab_set_proc sets the iab capability vectors of the current
 * process.
 */
int cap_iab_set_proc(cap_iab_t iab)
{
    int retval;
    if (!good_cap_iab_t(iab)) {
	errno = EINVAL;
	return -1;
    }
    _cap_mu_lock(&iab->mutex);
    retval = _cap_iab_set_proc(&multithread, iab);
    _cap_mu_unlock(&iab->mutex);
    return retval;
}

/*
 * cap_launcher_callback primes the launcher with a callback that will
 * be invoked after the fork() but before any privilege has changed
 * and before the execve(). This can be used to augment the state of
 * the child process within the cap_launch() process. You can cancel
 * any callback associated with a launcher by calling this function
 * with a callback_fn value NULL.
 *
 * If the callback function returns anything other than 0, it is
 * considered to have failed and the launch will be aborted - further,
 * errno will be communicated to the parent.
 */
int cap_launcher_callback(cap_launch_t attr, int (callback_fn)(void *detail))
{
    if (!good_cap_launch_t(attr)) {
	errno = EINVAL;
	return -1;
    }
    _cap_mu_lock(&attr->mutex);
    attr->custom_setup_fn = callback_fn;
    _cap_mu_unlock(&attr->mutex);
    return 0;
}

/*
 * cap_launcher_setuid primes the launcher to attempt a change of uid.
 */
int cap_launcher_setuid(cap_launch_t attr, uid_t uid)
{
    if (!good_cap_launch_t(attr)) {
	errno = EINVAL;
	return -1;
    }
    _cap_mu_lock(&attr->mutex);
    attr->uid = uid;
    attr->change_uids = 1;
    _cap_mu_unlock(&attr->mutex);
    return 0;
}

/*
 * cap_launcher_setgroups primes the launcher to attempt a change of
 * gid and groups.
 */
int cap_launcher_setgroups(cap_launch_t attr, gid_t gid,
			   int ngroups, const gid_t *groups)
{
    if (!good_cap_launch_t(attr)) {
	errno = EINVAL;
	return -1;
    }
    _cap_mu_lock(&attr->mutex);
    attr->gid = gid;
    attr->ngroups = ngroups;
    attr->groups = groups;
    attr->change_gids = 1;
    _cap_mu_unlock(&attr->mutex);
    return 0;
}

/*
 * cap_launcher_set_mode primes the launcher to attempt a change of
 * mode.
 */
int cap_launcher_set_mode(cap_launch_t attr, cap_mode_t flavor)
{
    if (!good_cap_launch_t(attr)) {
	errno = EINVAL;
	return -1;
    }
    _cap_mu_lock(&attr->mutex);
    attr->mode = flavor;
    attr->change_mode = 1;
    _cap_mu_unlock(&attr->mutex);
    return 0;
}

/*
 * cap_launcher_set_iab primes the launcher to attempt to change the
 * IAB values of the launched child. The launcher locks iab while it
 * is owned by the launcher: this prevents the user from
 * asynchronously changing its value while it is associated with the
 * launcher.
 */
cap_iab_t cap_launcher_set_iab(cap_launch_t attr, cap_iab_t iab)
{
    if (!good_cap_launch_t(attr)) {
	errno = EINVAL;
	return NULL;
    }
    _cap_mu_lock(&attr->mutex);
    cap_iab_t old = attr->iab;
    attr->iab = iab;
    if (old != NULL) {
	_cap_mu_unlock(&old->mutex);
    }
    if (iab != NULL) {
	_cap_mu_lock(&iab->mutex);
    }
    _cap_mu_unlock(&attr->mutex);
    return old;
}

/*
 * cap_launcher_set_chroot sets the intended chroot for the launched
 * child.
 */
int cap_launcher_set_chroot(cap_launch_t attr, const char *chroot)
{
    if (!good_cap_launch_t(attr)) {
	errno = EINVAL;
	return -1;
    }
    _cap_mu_lock(&attr->mutex);
    attr->chroot = _libcap_strdup(chroot);
    _cap_mu_unlock(&attr->mutex);
    return 0;
}

static int _cap_chroot(struct syscaller_s *sc, const char *root)
{
    const cap_value_t raise_cap_sys_chroot[] = {CAP_SYS_CHROOT};
    cap_t working = cap_get_proc();
    if (working == NULL) {
	return -1;
    }

    (void) cap_set_flag(working, CAP_EFFECTIVE,
			1, raise_cap_sys_chroot, CAP_SET);
    int ret = _cap_set_proc(sc, working);
    if (ret == 0) {
	if (_libcap_overrode_syscalls) {
	    ret = sc->three(SYS_chroot, (long int) root, 0, 0);
	    if (ret < 0) {
		errno = -ret;
		ret = -1;
	    }
	} else {
	    ret = chroot(root);
	}
	if (ret == 0) {
	    ret = chdir("/");
	}
    }
    int olderrno = errno;
    (void) cap_clear_flag(working, CAP_EFFECTIVE);
    (void) _cap_set_proc(sc, working);
    (void) cap_free(working);

    errno = olderrno;
    return ret;
}

/*
 * _cap_launch is invoked in the forked child, it cannot return but is
 * required to exit, if the execve fails. It will write the errno
 * value for any failure over the filedescriptor, fd, and exit with
 * status 1.
 */
__attribute__ ((noreturn))
static void _cap_launch(int fd, cap_launch_t attr, void *detail) {
    struct syscaller_s *sc = &singlethread;
    int my_errno;

    if (attr->custom_setup_fn && attr->custom_setup_fn(detail)) {
	goto defer;
    }
    if (attr->arg0 == NULL) {
	/* handle the successful cap_func_launcher completion */
	exit(0);
    }

    if (attr->change_uids && _cap_setuid(sc, attr->uid)) {
	goto defer;
    }
    if (attr->change_gids &&
	_cap_setgroups(sc, attr->gid, attr->ngroups, attr->groups)) {
	goto defer;
    }
    if (attr->change_mode && _cap_set_mode(sc, attr->mode)) {
	goto defer;
    }
    if (attr->iab && _cap_iab_set_proc(sc, attr->iab)) {
	goto defer;
    }
    if (attr->chroot != NULL && _cap_chroot(sc, attr->chroot)) {
	goto defer;
    }

    /*
     * Some type wrangling to work around what the kernel API really
     * means: not "const char **".
     */
    const void *temp_args = attr->argv;
    const void *temp_envp = attr->envp;

    execve(attr->arg0, temp_args, temp_envp);
    /* if the exec worked, execution will not reach here */

defer:
    /*
     * getting here means an error has occurred and errno is
     * communicated to the parent
     */
    my_errno = errno;
    for (;;) {
	int n = write(fd, &my_errno, sizeof(my_errno));
	if (n < 0 && errno == EAGAIN) {
	    continue;
	}
	break;
    }
    close(fd);
    exit(1);
}

/*
 * cap_launch performs a wrapped fork+(callback and/or exec) that
 * works in both an unthreaded environment and also where libcap is
 * linked with psx+pthreads. The function supports dropping privilege
 * in the forked thread, but retaining privilege in the parent
 * thread(s).
 *
 * When applying the IAB vector inside the fork, since the ambient set
 * is fragile with respect to changes in I or P, the function
 * carefully orders setting of these inheritable characteristics, to
 * make sure they stick.
 *
 * This function will return an error of -1 setting errno if the
 * launch failed.
 */
pid_t cap_launch(cap_launch_t attr, void *detail) {
    int my_errno;
    int ps[2];
    pid_t child;

    if (!good_cap_launch_t(attr)) {
	errno = EINVAL;
	return -1;
    }
    _cap_mu_lock(&attr->mutex);

    /* The launch must have a purpose */
    if (attr->custom_setup_fn == NULL &&
	(attr->arg0 == NULL || attr->argv == NULL)) {
	errno = EINVAL;
	_cap_mu_unlock_return(&attr->mutex, -1);
    }

    if (pipe2(ps, O_CLOEXEC) != 0) {
	_cap_mu_unlock_return(&attr->mutex, -1);
    }

    child = fork();
    my_errno = errno;

    if (!child) {
	close(ps[0]);
	prctl(PR_SET_NAME, "cap-launcher", 0, 0, 0);
	_cap_launch(ps[1], attr, detail);
	/* no return from above function */
    }

    /* child has its own copy, and parent no longer needs it locked. */
    _cap_mu_unlock(&attr->mutex);
    close(ps[1]);
    if (child < 0) {
	goto defer;
    }

    /*
     * Extend this function's return codes to include setup failures
     * in the child.
     */
    for (;;) {
	int ignored;
	int n = read(ps[0], &my_errno, sizeof(my_errno));
	if (n == 0) {
	    goto defer;
	}
	if (n < 0 && errno == EAGAIN) {
	    continue;
	}
	waitpid(child, &ignored, 0);
	child = -1;
	my_errno = ECHILD;
	break;
    }

defer:
    close(ps[0]);
    errno = my_errno;
    return child;
}