cred.h 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425
  1. /* SPDX-License-Identifier: GPL-2.0-or-later */
  2. /* Credentials management - see Documentation/security/credentials.rst
  3. *
  4. * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved.
  5. * Written by David Howells (dhowells@redhat.com)
  6. */
  7. #ifndef _LINUX_CRED_H
  8. #define _LINUX_CRED_H
  9. #include <linux/capability.h>
  10. #include <linux/init.h>
  11. #include <linux/key.h>
  12. #include <linux/atomic.h>
  13. #include <linux/uidgid.h>
  14. #include <linux/sched.h>
  15. #include <linux/sched/user.h>
  16. struct cred;
  17. struct inode;
  18. /*
  19. * COW Supplementary groups list
  20. */
  21. struct group_info {
  22. atomic_t usage;
  23. int ngroups;
  24. kgid_t gid[0];
  25. } __randomize_layout;
  26. /**
  27. * get_group_info - Get a reference to a group info structure
  28. * @group_info: The group info to reference
  29. *
  30. * This gets a reference to a set of supplementary groups.
  31. *
  32. * If the caller is accessing a task's credentials, they must hold the RCU read
  33. * lock when reading.
  34. */
  35. static inline struct group_info *get_group_info(struct group_info *gi)
  36. {
  37. atomic_inc(&gi->usage);
  38. return gi;
  39. }
  40. /**
  41. * put_group_info - Release a reference to a group info structure
  42. * @group_info: The group info to release
  43. */
  44. #define put_group_info(group_info) \
  45. do { \
  46. if (atomic_dec_and_test(&(group_info)->usage)) \
  47. groups_free(group_info); \
  48. } while (0)
  49. extern struct group_info init_groups;
  50. #ifdef CONFIG_MULTIUSER
  51. extern struct group_info *groups_alloc(int);
  52. extern void groups_free(struct group_info *);
  53. extern int in_group_p(kgid_t);
  54. extern int in_egroup_p(kgid_t);
  55. extern int groups_search(const struct group_info *, kgid_t);
  56. extern int set_current_groups(struct group_info *);
  57. extern void set_groups(struct cred *, struct group_info *);
  58. extern bool may_setgroups(void);
  59. extern void groups_sort(struct group_info *);
  60. #else
  61. static inline void groups_free(struct group_info *group_info)
  62. {
  63. }
  64. static inline int in_group_p(kgid_t grp)
  65. {
  66. return 1;
  67. }
  68. static inline int in_egroup_p(kgid_t grp)
  69. {
  70. return 1;
  71. }
  72. static inline int groups_search(const struct group_info *group_info, kgid_t grp)
  73. {
  74. return 1;
  75. }
  76. #endif
  77. /*
  78. * The security context of a task
  79. *
  80. * The parts of the context break down into two categories:
  81. *
  82. * (1) The objective context of a task. These parts are used when some other
  83. * task is attempting to affect this one.
  84. *
  85. * (2) The subjective context. These details are used when the task is acting
  86. * upon another object, be that a file, a task, a key or whatever.
  87. *
  88. * Note that some members of this structure belong to both categories - the
  89. * LSM security pointer for instance.
  90. *
  91. * A task has two security pointers. task->real_cred points to the objective
  92. * context that defines that task's actual details. The objective part of this
  93. * context is used whenever that task is acted upon.
  94. *
  95. * task->cred points to the subjective context that defines the details of how
  96. * that task is going to act upon another object. This may be overridden
  97. * temporarily to point to another security context, but normally points to the
  98. * same context as task->real_cred.
  99. */
  100. struct cred {
  101. atomic_t usage;
  102. #ifdef CONFIG_DEBUG_CREDENTIALS
  103. atomic_t subscribers; /* number of processes subscribed */
  104. void *put_addr;
  105. unsigned magic;
  106. #define CRED_MAGIC 0x43736564
  107. #define CRED_MAGIC_DEAD 0x44656144
  108. #endif
  109. kuid_t uid; /* real UID of the task */
  110. kgid_t gid; /* real GID of the task */
  111. kuid_t suid; /* saved UID of the task */
  112. kgid_t sgid; /* saved GID of the task */
  113. kuid_t euid; /* effective UID of the task */
  114. kgid_t egid; /* effective GID of the task */
  115. kuid_t fsuid; /* UID for VFS ops */
  116. kgid_t fsgid; /* GID for VFS ops */
  117. unsigned securebits; /* SUID-less security management */
  118. kernel_cap_t cap_inheritable; /* caps our children can inherit */
  119. kernel_cap_t cap_permitted; /* caps we're permitted */
  120. kernel_cap_t cap_effective; /* caps we can actually use */
  121. kernel_cap_t cap_bset; /* capability bounding set */
  122. kernel_cap_t cap_ambient; /* Ambient capability set */
  123. #ifdef CONFIG_KEYS
  124. unsigned char jit_keyring; /* default keyring to attach requested
  125. * keys to */
  126. struct key *session_keyring; /* keyring inherited over fork */
  127. struct key *process_keyring; /* keyring private to this process */
  128. struct key *thread_keyring; /* keyring private to this thread */
  129. struct key *request_key_auth; /* assumed request_key authority */
  130. #endif
  131. #ifdef CONFIG_SECURITY
  132. void *security; /* subjective LSM security */
  133. #endif
  134. struct user_struct *user; /* real user ID subscription */
  135. struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
  136. struct group_info *group_info; /* supplementary groups for euid/fsgid */
  137. /* RCU deletion */
  138. union {
  139. int non_rcu; /* Can we skip RCU deletion? */
  140. struct rcu_head rcu; /* RCU deletion hook */
  141. };
  142. } __randomize_layout;
  143. extern void __put_cred(struct cred *);
  144. extern void exit_creds(struct task_struct *);
  145. extern int copy_creds(struct task_struct *, unsigned long);
  146. extern const struct cred *get_task_cred(struct task_struct *);
  147. extern struct cred *cred_alloc_blank(void);
  148. extern struct cred *prepare_creds(void);
  149. extern struct cred *prepare_exec_creds(void);
  150. extern int commit_creds(struct cred *);
  151. extern void abort_creds(struct cred *);
  152. extern const struct cred *override_creds(const struct cred *);
  153. extern void revert_creds(const struct cred *);
  154. extern struct cred *prepare_kernel_cred(struct task_struct *);
  155. extern int change_create_files_as(struct cred *, struct inode *);
  156. extern int set_security_override(struct cred *, u32);
  157. extern int set_security_override_from_ctx(struct cred *, const char *);
  158. extern int set_create_files_as(struct cred *, struct inode *);
  159. extern int cred_fscmp(const struct cred *, const struct cred *);
  160. extern void __init cred_init(void);
  161. /*
  162. * check for validity of credentials
  163. */
  164. #ifdef CONFIG_DEBUG_CREDENTIALS
  165. extern void __invalid_creds(const struct cred *, const char *, unsigned);
  166. extern void __validate_process_creds(struct task_struct *,
  167. const char *, unsigned);
  168. extern bool creds_are_invalid(const struct cred *cred);
  169. static inline void __validate_creds(const struct cred *cred,
  170. const char *file, unsigned line)
  171. {
  172. if (unlikely(creds_are_invalid(cred)))
  173. __invalid_creds(cred, file, line);
  174. }
  175. #define validate_creds(cred) \
  176. do { \
  177. __validate_creds((cred), __FILE__, __LINE__); \
  178. } while(0)
  179. #define validate_process_creds() \
  180. do { \
  181. __validate_process_creds(current, __FILE__, __LINE__); \
  182. } while(0)
  183. extern void validate_creds_for_do_exit(struct task_struct *);
  184. #else
  185. static inline void validate_creds(const struct cred *cred)
  186. {
  187. }
  188. static inline void validate_creds_for_do_exit(struct task_struct *tsk)
  189. {
  190. }
  191. static inline void validate_process_creds(void)
  192. {
  193. }
  194. #endif
  195. static inline bool cap_ambient_invariant_ok(const struct cred *cred)
  196. {
  197. return cap_issubset(cred->cap_ambient,
  198. cap_intersect(cred->cap_permitted,
  199. cred->cap_inheritable));
  200. }
  201. /**
  202. * get_new_cred - Get a reference on a new set of credentials
  203. * @cred: The new credentials to reference
  204. *
  205. * Get a reference on the specified set of new credentials. The caller must
  206. * release the reference.
  207. */
  208. static inline struct cred *get_new_cred(struct cred *cred)
  209. {
  210. atomic_inc(&cred->usage);
  211. return cred;
  212. }
  213. /**
  214. * get_cred - Get a reference on a set of credentials
  215. * @cred: The credentials to reference
  216. *
  217. * Get a reference on the specified set of credentials. The caller must
  218. * release the reference. If %NULL is passed, it is returned with no action.
  219. *
  220. * This is used to deal with a committed set of credentials. Although the
  221. * pointer is const, this will temporarily discard the const and increment the
  222. * usage count. The purpose of this is to attempt to catch at compile time the
  223. * accidental alteration of a set of credentials that should be considered
  224. * immutable.
  225. */
  226. static inline const struct cred *get_cred(const struct cred *cred)
  227. {
  228. struct cred *nonconst_cred = (struct cred *) cred;
  229. if (!cred)
  230. return cred;
  231. validate_creds(cred);
  232. nonconst_cred->non_rcu = 0;
  233. return get_new_cred(nonconst_cred);
  234. }
  235. static inline const struct cred *get_cred_rcu(const struct cred *cred)
  236. {
  237. struct cred *nonconst_cred = (struct cred *) cred;
  238. if (!cred)
  239. return NULL;
  240. if (!atomic_inc_not_zero(&nonconst_cred->usage))
  241. return NULL;
  242. validate_creds(cred);
  243. nonconst_cred->non_rcu = 0;
  244. return cred;
  245. }
  246. /**
  247. * put_cred - Release a reference to a set of credentials
  248. * @cred: The credentials to release
  249. *
  250. * Release a reference to a set of credentials, deleting them when the last ref
  251. * is released. If %NULL is passed, nothing is done.
  252. *
  253. * This takes a const pointer to a set of credentials because the credentials
  254. * on task_struct are attached by const pointers to prevent accidental
  255. * alteration of otherwise immutable credential sets.
  256. */
  257. static inline void put_cred(const struct cred *_cred)
  258. {
  259. struct cred *cred = (struct cred *) _cred;
  260. if (cred) {
  261. validate_creds(cred);
  262. if (atomic_dec_and_test(&(cred)->usage))
  263. __put_cred(cred);
  264. }
  265. }
  266. /**
  267. * current_cred - Access the current task's subjective credentials
  268. *
  269. * Access the subjective credentials of the current task. RCU-safe,
  270. * since nobody else can modify it.
  271. */
  272. #define current_cred() \
  273. rcu_dereference_protected(current->cred, 1)
  274. /**
  275. * current_real_cred - Access the current task's objective credentials
  276. *
  277. * Access the objective credentials of the current task. RCU-safe,
  278. * since nobody else can modify it.
  279. */
  280. #define current_real_cred() \
  281. rcu_dereference_protected(current->real_cred, 1)
  282. /**
  283. * __task_cred - Access a task's objective credentials
  284. * @task: The task to query
  285. *
  286. * Access the objective credentials of a task. The caller must hold the RCU
  287. * readlock.
  288. *
  289. * The result of this function should not be passed directly to get_cred();
  290. * rather get_task_cred() should be used instead.
  291. */
  292. #define __task_cred(task) \
  293. rcu_dereference((task)->real_cred)
  294. /**
  295. * get_current_cred - Get the current task's subjective credentials
  296. *
  297. * Get the subjective credentials of the current task, pinning them so that
  298. * they can't go away. Accessing the current task's credentials directly is
  299. * not permitted.
  300. */
  301. #define get_current_cred() \
  302. (get_cred(current_cred()))
  303. /**
  304. * get_current_user - Get the current task's user_struct
  305. *
  306. * Get the user record of the current task, pinning it so that it can't go
  307. * away.
  308. */
  309. #define get_current_user() \
  310. ({ \
  311. struct user_struct *__u; \
  312. const struct cred *__cred; \
  313. __cred = current_cred(); \
  314. __u = get_uid(__cred->user); \
  315. __u; \
  316. })
  317. /**
  318. * get_current_groups - Get the current task's supplementary group list
  319. *
  320. * Get the supplementary group list of the current task, pinning it so that it
  321. * can't go away.
  322. */
  323. #define get_current_groups() \
  324. ({ \
  325. struct group_info *__groups; \
  326. const struct cred *__cred; \
  327. __cred = current_cred(); \
  328. __groups = get_group_info(__cred->group_info); \
  329. __groups; \
  330. })
  331. #define task_cred_xxx(task, xxx) \
  332. ({ \
  333. __typeof__(((struct cred *)NULL)->xxx) ___val; \
  334. rcu_read_lock(); \
  335. ___val = __task_cred((task))->xxx; \
  336. rcu_read_unlock(); \
  337. ___val; \
  338. })
  339. #define task_uid(task) (task_cred_xxx((task), uid))
  340. #define task_euid(task) (task_cred_xxx((task), euid))
  341. #define current_cred_xxx(xxx) \
  342. ({ \
  343. current_cred()->xxx; \
  344. })
  345. #define current_uid() (current_cred_xxx(uid))
  346. #define current_gid() (current_cred_xxx(gid))
  347. #define current_euid() (current_cred_xxx(euid))
  348. #define current_egid() (current_cred_xxx(egid))
  349. #define current_suid() (current_cred_xxx(suid))
  350. #define current_sgid() (current_cred_xxx(sgid))
  351. #define current_fsuid() (current_cred_xxx(fsuid))
  352. #define current_fsgid() (current_cred_xxx(fsgid))
  353. #define current_cap() (current_cred_xxx(cap_effective))
  354. #define current_user() (current_cred_xxx(user))
  355. extern struct user_namespace init_user_ns;
  356. #ifdef CONFIG_USER_NS
  357. #define current_user_ns() (current_cred_xxx(user_ns))
  358. #else
  359. static inline struct user_namespace *current_user_ns(void)
  360. {
  361. return &init_user_ns;
  362. }
  363. #endif
  364. #define current_uid_gid(_uid, _gid) \
  365. do { \
  366. const struct cred *__cred; \
  367. __cred = current_cred(); \
  368. *(_uid) = __cred->uid; \
  369. *(_gid) = __cred->gid; \
  370. } while(0)
  371. #define current_euid_egid(_euid, _egid) \
  372. do { \
  373. const struct cred *__cred; \
  374. __cred = current_cred(); \
  375. *(_euid) = __cred->euid; \
  376. *(_egid) = __cred->egid; \
  377. } while(0)
  378. #define current_fsuid_fsgid(_fsuid, _fsgid) \
  379. do { \
  380. const struct cred *__cred; \
  381. __cred = current_cred(); \
  382. *(_fsuid) = __cred->fsuid; \
  383. *(_fsgid) = __cred->fsgid; \
  384. } while(0)
  385. #endif /* _LINUX_CRED_H */