cred.c 24 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* Task credentials management - see Documentation/security/credentials.rst
  3. *
  4. * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved.
  5. * Written by David Howells (dhowells@redhat.com)
  6. */
  7. #include <linux/export.h>
  8. #include <linux/cred.h>
  9. #include <linux/slab.h>
  10. #include <linux/sched.h>
  11. #include <linux/sched/coredump.h>
  12. #include <linux/key.h>
  13. #include <linux/keyctl.h>
  14. #include <linux/init_task.h>
  15. #include <linux/security.h>
  16. #include <linux/binfmts.h>
  17. #include <linux/cn_proc.h>
  18. #include <linux/uidgid.h>
  19. #include <trace/hooks/creds.h>
  20. #if 0
  21. #define kdebug(FMT, ...) \
  22. printk("[%-5.5s%5u] " FMT "\n", \
  23. current->comm, current->pid, ##__VA_ARGS__)
  24. #else
  25. #define kdebug(FMT, ...) \
  26. do { \
  27. if (0) \
  28. no_printk("[%-5.5s%5u] " FMT "\n", \
  29. current->comm, current->pid, ##__VA_ARGS__); \
  30. } while (0)
  31. #endif
  32. static struct kmem_cache *cred_jar;
  33. /* init to 2 - one for init_task, one to ensure it is never freed */
  34. struct group_info init_groups = { .usage = ATOMIC_INIT(2) };
  35. /*
  36. * The initial credentials for the initial task
  37. */
  38. struct cred init_cred = {
  39. .usage = ATOMIC_INIT(4),
  40. #ifdef CONFIG_DEBUG_CREDENTIALS
  41. .subscribers = ATOMIC_INIT(2),
  42. .magic = CRED_MAGIC,
  43. #endif
  44. .uid = GLOBAL_ROOT_UID,
  45. .gid = GLOBAL_ROOT_GID,
  46. .suid = GLOBAL_ROOT_UID,
  47. .sgid = GLOBAL_ROOT_GID,
  48. .euid = GLOBAL_ROOT_UID,
  49. .egid = GLOBAL_ROOT_GID,
  50. .fsuid = GLOBAL_ROOT_UID,
  51. .fsgid = GLOBAL_ROOT_GID,
  52. .securebits = SECUREBITS_DEFAULT,
  53. .cap_inheritable = CAP_EMPTY_SET,
  54. .cap_permitted = CAP_FULL_SET,
  55. .cap_effective = CAP_FULL_SET,
  56. .cap_bset = CAP_FULL_SET,
  57. .user = INIT_USER,
  58. .user_ns = &init_user_ns,
  59. .group_info = &init_groups,
  60. };
  61. static inline void set_cred_subscribers(struct cred *cred, int n)
  62. {
  63. #ifdef CONFIG_DEBUG_CREDENTIALS
  64. atomic_set(&cred->subscribers, n);
  65. #endif
  66. }
  67. static inline int read_cred_subscribers(const struct cred *cred)
  68. {
  69. #ifdef CONFIG_DEBUG_CREDENTIALS
  70. return atomic_read(&cred->subscribers);
  71. #else
  72. return 0;
  73. #endif
  74. }
  75. static inline void alter_cred_subscribers(const struct cred *_cred, int n)
  76. {
  77. #ifdef CONFIG_DEBUG_CREDENTIALS
  78. struct cred *cred = (struct cred *) _cred;
  79. atomic_add(n, &cred->subscribers);
  80. #endif
  81. }
  82. /*
  83. * The RCU callback to actually dispose of a set of credentials
  84. */
  85. static void put_cred_rcu(struct rcu_head *rcu)
  86. {
  87. struct cred *cred = container_of(rcu, struct cred, rcu);
  88. kdebug("put_cred_rcu(%p)", cred);
  89. #ifdef CONFIG_DEBUG_CREDENTIALS
  90. if (cred->magic != CRED_MAGIC_DEAD ||
  91. atomic_read(&cred->usage) != 0 ||
  92. read_cred_subscribers(cred) != 0)
  93. panic("CRED: put_cred_rcu() sees %p with"
  94. " mag %x, put %p, usage %d, subscr %d\n",
  95. cred, cred->magic, cred->put_addr,
  96. atomic_read(&cred->usage),
  97. read_cred_subscribers(cred));
  98. #else
  99. if (atomic_read(&cred->usage) != 0)
  100. panic("CRED: put_cred_rcu() sees %p with usage %d\n",
  101. cred, atomic_read(&cred->usage));
  102. #endif
  103. security_cred_free(cred);
  104. key_put(cred->session_keyring);
  105. key_put(cred->process_keyring);
  106. key_put(cred->thread_keyring);
  107. key_put(cred->request_key_auth);
  108. if (cred->group_info)
  109. put_group_info(cred->group_info);
  110. free_uid(cred->user);
  111. put_user_ns(cred->user_ns);
  112. kmem_cache_free(cred_jar, cred);
  113. }
  114. /**
  115. * __put_cred - Destroy a set of credentials
  116. * @cred: The record to release
  117. *
  118. * Destroy a set of credentials on which no references remain.
  119. */
  120. void __put_cred(struct cred *cred)
  121. {
  122. kdebug("__put_cred(%p{%d,%d})", cred,
  123. atomic_read(&cred->usage),
  124. read_cred_subscribers(cred));
  125. BUG_ON(atomic_read(&cred->usage) != 0);
  126. #ifdef CONFIG_DEBUG_CREDENTIALS
  127. BUG_ON(read_cred_subscribers(cred) != 0);
  128. cred->magic = CRED_MAGIC_DEAD;
  129. cred->put_addr = __builtin_return_address(0);
  130. #endif
  131. BUG_ON(cred == current->cred);
  132. BUG_ON(cred == current->real_cred);
  133. if (cred->non_rcu)
  134. put_cred_rcu(&cred->rcu);
  135. else
  136. call_rcu(&cred->rcu, put_cred_rcu);
  137. }
  138. EXPORT_SYMBOL(__put_cred);
  139. /*
  140. * Clean up a task's credentials when it exits
  141. */
  142. void exit_creds(struct task_struct *tsk)
  143. {
  144. struct cred *cred;
  145. kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
  146. atomic_read(&tsk->cred->usage),
  147. read_cred_subscribers(tsk->cred));
  148. cred = (struct cred *) tsk->real_cred;
  149. tsk->real_cred = NULL;
  150. validate_creds(cred);
  151. alter_cred_subscribers(cred, -1);
  152. put_cred(cred);
  153. cred = (struct cred *) tsk->cred;
  154. tsk->cred = NULL;
  155. validate_creds(cred);
  156. alter_cred_subscribers(cred, -1);
  157. put_cred(cred);
  158. #ifdef CONFIG_KEYS_REQUEST_CACHE
  159. key_put(tsk->cached_requested_key);
  160. tsk->cached_requested_key = NULL;
  161. #endif
  162. trace_android_vh_exit_creds(tsk, cred);
  163. }
  164. /**
  165. * get_task_cred - Get another task's objective credentials
  166. * @task: The task to query
  167. *
  168. * Get the objective credentials of a task, pinning them so that they can't go
  169. * away. Accessing a task's credentials directly is not permitted.
  170. *
  171. * The caller must also make sure task doesn't get deleted, either by holding a
  172. * ref on task or by holding tasklist_lock to prevent it from being unlinked.
  173. */
  174. const struct cred *get_task_cred(struct task_struct *task)
  175. {
  176. const struct cred *cred;
  177. rcu_read_lock();
  178. do {
  179. cred = __task_cred((task));
  180. BUG_ON(!cred);
  181. } while (!get_cred_rcu(cred));
  182. rcu_read_unlock();
  183. return cred;
  184. }
  185. EXPORT_SYMBOL(get_task_cred);
  186. /*
  187. * Allocate blank credentials, such that the credentials can be filled in at a
  188. * later date without risk of ENOMEM.
  189. */
  190. struct cred *cred_alloc_blank(void)
  191. {
  192. struct cred *new;
  193. new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
  194. if (!new)
  195. return NULL;
  196. atomic_set(&new->usage, 1);
  197. #ifdef CONFIG_DEBUG_CREDENTIALS
  198. new->magic = CRED_MAGIC;
  199. #endif
  200. if (security_cred_alloc_blank(new, GFP_KERNEL_ACCOUNT) < 0)
  201. goto error;
  202. return new;
  203. error:
  204. abort_creds(new);
  205. return NULL;
  206. }
  207. /**
  208. * prepare_creds - Prepare a new set of credentials for modification
  209. *
  210. * Prepare a new set of task credentials for modification. A task's creds
  211. * shouldn't generally be modified directly, therefore this function is used to
  212. * prepare a new copy, which the caller then modifies and then commits by
  213. * calling commit_creds().
  214. *
  215. * Preparation involves making a copy of the objective creds for modification.
  216. *
  217. * Returns a pointer to the new creds-to-be if successful, NULL otherwise.
  218. *
  219. * Call commit_creds() or abort_creds() to clean up.
  220. */
  221. struct cred *prepare_creds(void)
  222. {
  223. struct task_struct *task = current;
  224. const struct cred *old;
  225. struct cred *new;
  226. validate_process_creds();
  227. new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
  228. if (!new)
  229. return NULL;
  230. kdebug("prepare_creds() alloc %p", new);
  231. old = task->cred;
  232. memcpy(new, old, sizeof(struct cred));
  233. new->non_rcu = 0;
  234. atomic_set(&new->usage, 1);
  235. set_cred_subscribers(new, 0);
  236. get_group_info(new->group_info);
  237. get_uid(new->user);
  238. get_user_ns(new->user_ns);
  239. #ifdef CONFIG_KEYS
  240. key_get(new->session_keyring);
  241. key_get(new->process_keyring);
  242. key_get(new->thread_keyring);
  243. key_get(new->request_key_auth);
  244. #endif
  245. #ifdef CONFIG_SECURITY
  246. new->security = NULL;
  247. #endif
  248. if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
  249. goto error;
  250. validate_creds(new);
  251. return new;
  252. error:
  253. abort_creds(new);
  254. return NULL;
  255. }
  256. EXPORT_SYMBOL(prepare_creds);
  257. /*
  258. * Prepare credentials for current to perform an execve()
  259. * - The caller must hold ->cred_guard_mutex
  260. */
  261. struct cred *prepare_exec_creds(void)
  262. {
  263. struct cred *new;
  264. new = prepare_creds();
  265. if (!new)
  266. return new;
  267. #ifdef CONFIG_KEYS
  268. /* newly exec'd tasks don't get a thread keyring */
  269. key_put(new->thread_keyring);
  270. new->thread_keyring = NULL;
  271. /* inherit the session keyring; new process keyring */
  272. key_put(new->process_keyring);
  273. new->process_keyring = NULL;
  274. #endif
  275. new->suid = new->fsuid = new->euid;
  276. new->sgid = new->fsgid = new->egid;
  277. return new;
  278. }
  279. /*
  280. * Copy credentials for the new process created by fork()
  281. *
  282. * We share if we can, but under some circumstances we have to generate a new
  283. * set.
  284. *
  285. * The new process gets the current process's subjective credentials as its
  286. * objective and subjective credentials
  287. */
  288. int copy_creds(struct task_struct *p, unsigned long clone_flags)
  289. {
  290. struct cred *new;
  291. int ret;
  292. #ifdef CONFIG_KEYS_REQUEST_CACHE
  293. p->cached_requested_key = NULL;
  294. #endif
  295. if (
  296. #ifdef CONFIG_KEYS
  297. !p->cred->thread_keyring &&
  298. #endif
  299. clone_flags & CLONE_THREAD
  300. ) {
  301. p->real_cred = get_cred(p->cred);
  302. get_cred(p->cred);
  303. alter_cred_subscribers(p->cred, 2);
  304. kdebug("share_creds(%p{%d,%d})",
  305. p->cred, atomic_read(&p->cred->usage),
  306. read_cred_subscribers(p->cred));
  307. atomic_inc(&p->cred->user->processes);
  308. return 0;
  309. }
  310. new = prepare_creds();
  311. if (!new)
  312. return -ENOMEM;
  313. if (clone_flags & CLONE_NEWUSER) {
  314. ret = create_user_ns(new);
  315. if (ret < 0)
  316. goto error_put;
  317. }
  318. #ifdef CONFIG_KEYS
  319. /* new threads get their own thread keyrings if their parent already
  320. * had one */
  321. if (new->thread_keyring) {
  322. key_put(new->thread_keyring);
  323. new->thread_keyring = NULL;
  324. if (clone_flags & CLONE_THREAD)
  325. install_thread_keyring_to_cred(new);
  326. }
  327. /* The process keyring is only shared between the threads in a process;
  328. * anything outside of those threads doesn't inherit.
  329. */
  330. if (!(clone_flags & CLONE_THREAD)) {
  331. key_put(new->process_keyring);
  332. new->process_keyring = NULL;
  333. }
  334. #endif
  335. atomic_inc(&new->user->processes);
  336. p->cred = p->real_cred = get_cred(new);
  337. alter_cred_subscribers(new, 2);
  338. validate_creds(new);
  339. return 0;
  340. error_put:
  341. put_cred(new);
  342. return ret;
  343. }
  344. static bool cred_cap_issubset(const struct cred *set, const struct cred *subset)
  345. {
  346. const struct user_namespace *set_ns = set->user_ns;
  347. const struct user_namespace *subset_ns = subset->user_ns;
  348. /* If the two credentials are in the same user namespace see if
  349. * the capabilities of subset are a subset of set.
  350. */
  351. if (set_ns == subset_ns)
  352. return cap_issubset(subset->cap_permitted, set->cap_permitted);
  353. /* The credentials are in a different user namespaces
  354. * therefore one is a subset of the other only if a set is an
  355. * ancestor of subset and set->euid is owner of subset or one
  356. * of subsets ancestors.
  357. */
  358. for (;subset_ns != &init_user_ns; subset_ns = subset_ns->parent) {
  359. if ((set_ns == subset_ns->parent) &&
  360. uid_eq(subset_ns->owner, set->euid))
  361. return true;
  362. }
  363. return false;
  364. }
  365. /**
  366. * commit_creds - Install new credentials upon the current task
  367. * @new: The credentials to be assigned
  368. *
  369. * Install a new set of credentials to the current task, using RCU to replace
  370. * the old set. Both the objective and the subjective credentials pointers are
  371. * updated. This function may not be called if the subjective credentials are
  372. * in an overridden state.
  373. *
  374. * This function eats the caller's reference to the new credentials.
  375. *
  376. * Always returns 0 thus allowing this function to be tail-called at the end
  377. * of, say, sys_setgid().
  378. */
  379. int commit_creds(struct cred *new)
  380. {
  381. struct task_struct *task = current;
  382. const struct cred *old = task->real_cred;
  383. kdebug("commit_creds(%p{%d,%d})", new,
  384. atomic_read(&new->usage),
  385. read_cred_subscribers(new));
  386. BUG_ON(task->cred != old);
  387. #ifdef CONFIG_DEBUG_CREDENTIALS
  388. BUG_ON(read_cred_subscribers(old) < 2);
  389. validate_creds(old);
  390. validate_creds(new);
  391. #endif
  392. BUG_ON(atomic_read(&new->usage) < 1);
  393. get_cred(new); /* we will require a ref for the subj creds too */
  394. /* dumpability changes */
  395. if (!uid_eq(old->euid, new->euid) ||
  396. !gid_eq(old->egid, new->egid) ||
  397. !uid_eq(old->fsuid, new->fsuid) ||
  398. !gid_eq(old->fsgid, new->fsgid) ||
  399. !cred_cap_issubset(old, new)) {
  400. if (task->mm)
  401. set_dumpable(task->mm, suid_dumpable);
  402. task->pdeath_signal = 0;
  403. /*
  404. * If a task drops privileges and becomes nondumpable,
  405. * the dumpability change must become visible before
  406. * the credential change; otherwise, a __ptrace_may_access()
  407. * racing with this change may be able to attach to a task it
  408. * shouldn't be able to attach to (as if the task had dropped
  409. * privileges without becoming nondumpable).
  410. * Pairs with a read barrier in __ptrace_may_access().
  411. */
  412. smp_wmb();
  413. }
  414. /* alter the thread keyring */
  415. if (!uid_eq(new->fsuid, old->fsuid))
  416. key_fsuid_changed(new);
  417. if (!gid_eq(new->fsgid, old->fsgid))
  418. key_fsgid_changed(new);
  419. /* do it
  420. * RLIMIT_NPROC limits on user->processes have already been checked
  421. * in set_user().
  422. */
  423. alter_cred_subscribers(new, 2);
  424. if (new->user != old->user)
  425. atomic_inc(&new->user->processes);
  426. rcu_assign_pointer(task->real_cred, new);
  427. rcu_assign_pointer(task->cred, new);
  428. trace_android_vh_commit_creds(task, new);
  429. if (new->user != old->user)
  430. atomic_dec(&old->user->processes);
  431. alter_cred_subscribers(old, -2);
  432. /* send notifications */
  433. if (!uid_eq(new->uid, old->uid) ||
  434. !uid_eq(new->euid, old->euid) ||
  435. !uid_eq(new->suid, old->suid) ||
  436. !uid_eq(new->fsuid, old->fsuid))
  437. proc_id_connector(task, PROC_EVENT_UID);
  438. if (!gid_eq(new->gid, old->gid) ||
  439. !gid_eq(new->egid, old->egid) ||
  440. !gid_eq(new->sgid, old->sgid) ||
  441. !gid_eq(new->fsgid, old->fsgid))
  442. proc_id_connector(task, PROC_EVENT_GID);
  443. /* release the old obj and subj refs both */
  444. put_cred(old);
  445. put_cred(old);
  446. return 0;
  447. }
  448. EXPORT_SYMBOL(commit_creds);
  449. /**
  450. * abort_creds - Discard a set of credentials and unlock the current task
  451. * @new: The credentials that were going to be applied
  452. *
  453. * Discard a set of credentials that were under construction and unlock the
  454. * current task.
  455. */
  456. void abort_creds(struct cred *new)
  457. {
  458. kdebug("abort_creds(%p{%d,%d})", new,
  459. atomic_read(&new->usage),
  460. read_cred_subscribers(new));
  461. #ifdef CONFIG_DEBUG_CREDENTIALS
  462. BUG_ON(read_cred_subscribers(new) != 0);
  463. #endif
  464. BUG_ON(atomic_read(&new->usage) < 1);
  465. put_cred(new);
  466. }
  467. EXPORT_SYMBOL(abort_creds);
  468. /**
  469. * override_creds - Override the current process's subjective credentials
  470. * @new: The credentials to be assigned
  471. *
  472. * Install a set of temporary override subjective credentials on the current
  473. * process, returning the old set for later reversion.
  474. */
  475. const struct cred *override_creds(const struct cred *new)
  476. {
  477. const struct cred *old = current->cred;
  478. kdebug("override_creds(%p{%d,%d})", new,
  479. atomic_read(&new->usage),
  480. read_cred_subscribers(new));
  481. validate_creds(old);
  482. validate_creds(new);
  483. /*
  484. * NOTE! This uses 'get_new_cred()' rather than 'get_cred()'.
  485. *
  486. * That means that we do not clear the 'non_rcu' flag, since
  487. * we are only installing the cred into the thread-synchronous
  488. * '->cred' pointer, not the '->real_cred' pointer that is
  489. * visible to other threads under RCU.
  490. *
  491. * Also note that we did validate_creds() manually, not depending
  492. * on the validation in 'get_cred()'.
  493. */
  494. get_new_cred((struct cred *)new);
  495. alter_cred_subscribers(new, 1);
  496. rcu_assign_pointer(current->cred, new);
  497. trace_android_vh_override_creds(current, new);
  498. alter_cred_subscribers(old, -1);
  499. kdebug("override_creds() = %p{%d,%d}", old,
  500. atomic_read(&old->usage),
  501. read_cred_subscribers(old));
  502. return old;
  503. }
  504. EXPORT_SYMBOL(override_creds);
  505. /**
  506. * revert_creds - Revert a temporary subjective credentials override
  507. * @old: The credentials to be restored
  508. *
  509. * Revert a temporary set of override subjective credentials to an old set,
  510. * discarding the override set.
  511. */
  512. void revert_creds(const struct cred *old)
  513. {
  514. const struct cred *override = current->cred;
  515. kdebug("revert_creds(%p{%d,%d})", old,
  516. atomic_read(&old->usage),
  517. read_cred_subscribers(old));
  518. validate_creds(old);
  519. validate_creds(override);
  520. alter_cred_subscribers(old, 1);
  521. rcu_assign_pointer(current->cred, old);
  522. trace_android_vh_revert_creds(current, old);
  523. alter_cred_subscribers(override, -1);
  524. put_cred(override);
  525. }
  526. EXPORT_SYMBOL(revert_creds);
  527. /**
  528. * cred_fscmp - Compare two credentials with respect to filesystem access.
  529. * @a: The first credential
  530. * @b: The second credential
  531. *
  532. * cred_cmp() will return zero if both credentials have the same
  533. * fsuid, fsgid, and supplementary groups. That is, if they will both
  534. * provide the same access to files based on mode/uid/gid.
  535. * If the credentials are different, then either -1 or 1 will
  536. * be returned depending on whether @a comes before or after @b
  537. * respectively in an arbitrary, but stable, ordering of credentials.
  538. *
  539. * Return: -1, 0, or 1 depending on comparison
  540. */
  541. int cred_fscmp(const struct cred *a, const struct cred *b)
  542. {
  543. struct group_info *ga, *gb;
  544. int g;
  545. if (a == b)
  546. return 0;
  547. if (uid_lt(a->fsuid, b->fsuid))
  548. return -1;
  549. if (uid_gt(a->fsuid, b->fsuid))
  550. return 1;
  551. if (gid_lt(a->fsgid, b->fsgid))
  552. return -1;
  553. if (gid_gt(a->fsgid, b->fsgid))
  554. return 1;
  555. ga = a->group_info;
  556. gb = b->group_info;
  557. if (ga == gb)
  558. return 0;
  559. if (ga == NULL)
  560. return -1;
  561. if (gb == NULL)
  562. return 1;
  563. if (ga->ngroups < gb->ngroups)
  564. return -1;
  565. if (ga->ngroups > gb->ngroups)
  566. return 1;
  567. for (g = 0; g < ga->ngroups; g++) {
  568. if (gid_lt(ga->gid[g], gb->gid[g]))
  569. return -1;
  570. if (gid_gt(ga->gid[g], gb->gid[g]))
  571. return 1;
  572. }
  573. return 0;
  574. }
  575. EXPORT_SYMBOL(cred_fscmp);
  576. /*
  577. * initialise the credentials stuff
  578. */
  579. void __init cred_init(void)
  580. {
  581. /* allocate a slab in which we can store credentials */
  582. cred_jar = kmem_cache_create("cred_jar", sizeof(struct cred), 0,
  583. SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, NULL);
  584. }
  585. /**
  586. * prepare_kernel_cred - Prepare a set of credentials for a kernel service
  587. * @daemon: A userspace daemon to be used as a reference
  588. *
  589. * Prepare a set of credentials for a kernel service. This can then be used to
  590. * override a task's own credentials so that work can be done on behalf of that
  591. * task that requires a different subjective context.
  592. *
  593. * @daemon is used to provide a base for the security record, but can be NULL.
  594. * If @daemon is supplied, then the security data will be derived from that;
  595. * otherwise they'll be set to 0 and no groups, full capabilities and no keys.
  596. *
  597. * The caller may change these controls afterwards if desired.
  598. *
  599. * Returns the new credentials or NULL if out of memory.
  600. */
  601. struct cred *prepare_kernel_cred(struct task_struct *daemon)
  602. {
  603. const struct cred *old;
  604. struct cred *new;
  605. new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
  606. if (!new)
  607. return NULL;
  608. kdebug("prepare_kernel_cred() alloc %p", new);
  609. if (daemon)
  610. old = get_task_cred(daemon);
  611. else
  612. old = get_cred(&init_cred);
  613. validate_creds(old);
  614. *new = *old;
  615. new->non_rcu = 0;
  616. atomic_set(&new->usage, 1);
  617. set_cred_subscribers(new, 0);
  618. get_uid(new->user);
  619. get_user_ns(new->user_ns);
  620. get_group_info(new->group_info);
  621. #ifdef CONFIG_KEYS
  622. new->session_keyring = NULL;
  623. new->process_keyring = NULL;
  624. new->thread_keyring = NULL;
  625. new->request_key_auth = NULL;
  626. new->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
  627. #endif
  628. #ifdef CONFIG_SECURITY
  629. new->security = NULL;
  630. #endif
  631. if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
  632. goto error;
  633. put_cred(old);
  634. validate_creds(new);
  635. return new;
  636. error:
  637. put_cred(new);
  638. put_cred(old);
  639. return NULL;
  640. }
  641. EXPORT_SYMBOL(prepare_kernel_cred);
  642. /**
  643. * set_security_override - Set the security ID in a set of credentials
  644. * @new: The credentials to alter
  645. * @secid: The LSM security ID to set
  646. *
  647. * Set the LSM security ID in a set of credentials so that the subjective
  648. * security is overridden when an alternative set of credentials is used.
  649. */
  650. int set_security_override(struct cred *new, u32 secid)
  651. {
  652. return security_kernel_act_as(new, secid);
  653. }
  654. EXPORT_SYMBOL(set_security_override);
  655. /**
  656. * set_security_override_from_ctx - Set the security ID in a set of credentials
  657. * @new: The credentials to alter
  658. * @secctx: The LSM security context to generate the security ID from.
  659. *
  660. * Set the LSM security ID in a set of credentials so that the subjective
  661. * security is overridden when an alternative set of credentials is used. The
  662. * security ID is specified in string form as a security context to be
  663. * interpreted by the LSM.
  664. */
  665. int set_security_override_from_ctx(struct cred *new, const char *secctx)
  666. {
  667. u32 secid;
  668. int ret;
  669. ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
  670. if (ret < 0)
  671. return ret;
  672. return set_security_override(new, secid);
  673. }
  674. EXPORT_SYMBOL(set_security_override_from_ctx);
  675. /**
  676. * set_create_files_as - Set the LSM file create context in a set of credentials
  677. * @new: The credentials to alter
  678. * @inode: The inode to take the context from
  679. *
  680. * Change the LSM file creation context in a set of credentials to be the same
  681. * as the object context of the specified inode, so that the new inodes have
  682. * the same MAC context as that inode.
  683. */
  684. int set_create_files_as(struct cred *new, struct inode *inode)
  685. {
  686. if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid))
  687. return -EINVAL;
  688. new->fsuid = inode->i_uid;
  689. new->fsgid = inode->i_gid;
  690. return security_kernel_create_files_as(new, inode);
  691. }
  692. EXPORT_SYMBOL(set_create_files_as);
  693. #ifdef CONFIG_DEBUG_CREDENTIALS
  694. bool creds_are_invalid(const struct cred *cred)
  695. {
  696. if (cred->magic != CRED_MAGIC)
  697. return true;
  698. return false;
  699. }
  700. EXPORT_SYMBOL(creds_are_invalid);
  701. /*
  702. * dump invalid credentials
  703. */
  704. static void dump_invalid_creds(const struct cred *cred, const char *label,
  705. const struct task_struct *tsk)
  706. {
  707. printk(KERN_ERR "CRED: %s credentials: %p %s%s%s\n",
  708. label, cred,
  709. cred == &init_cred ? "[init]" : "",
  710. cred == tsk->real_cred ? "[real]" : "",
  711. cred == tsk->cred ? "[eff]" : "");
  712. printk(KERN_ERR "CRED: ->magic=%x, put_addr=%p\n",
  713. cred->magic, cred->put_addr);
  714. printk(KERN_ERR "CRED: ->usage=%d, subscr=%d\n",
  715. atomic_read(&cred->usage),
  716. read_cred_subscribers(cred));
  717. printk(KERN_ERR "CRED: ->*uid = { %d,%d,%d,%d }\n",
  718. from_kuid_munged(&init_user_ns, cred->uid),
  719. from_kuid_munged(&init_user_ns, cred->euid),
  720. from_kuid_munged(&init_user_ns, cred->suid),
  721. from_kuid_munged(&init_user_ns, cred->fsuid));
  722. printk(KERN_ERR "CRED: ->*gid = { %d,%d,%d,%d }\n",
  723. from_kgid_munged(&init_user_ns, cred->gid),
  724. from_kgid_munged(&init_user_ns, cred->egid),
  725. from_kgid_munged(&init_user_ns, cred->sgid),
  726. from_kgid_munged(&init_user_ns, cred->fsgid));
  727. #ifdef CONFIG_SECURITY
  728. printk(KERN_ERR "CRED: ->security is %p\n", cred->security);
  729. if ((unsigned long) cred->security >= PAGE_SIZE &&
  730. (((unsigned long) cred->security & 0xffffff00) !=
  731. (POISON_FREE << 24 | POISON_FREE << 16 | POISON_FREE << 8)))
  732. printk(KERN_ERR "CRED: ->security {%x, %x}\n",
  733. ((u32*)cred->security)[0],
  734. ((u32*)cred->security)[1]);
  735. #endif
  736. }
  737. /*
  738. * report use of invalid credentials
  739. */
  740. void __invalid_creds(const struct cred *cred, const char *file, unsigned line)
  741. {
  742. printk(KERN_ERR "CRED: Invalid credentials\n");
  743. printk(KERN_ERR "CRED: At %s:%u\n", file, line);
  744. dump_invalid_creds(cred, "Specified", current);
  745. BUG();
  746. }
  747. EXPORT_SYMBOL(__invalid_creds);
  748. /*
  749. * check the credentials on a process
  750. */
  751. void __validate_process_creds(struct task_struct *tsk,
  752. const char *file, unsigned line)
  753. {
  754. if (tsk->cred == tsk->real_cred) {
  755. if (unlikely(read_cred_subscribers(tsk->cred) < 2 ||
  756. creds_are_invalid(tsk->cred)))
  757. goto invalid_creds;
  758. } else {
  759. if (unlikely(read_cred_subscribers(tsk->real_cred) < 1 ||
  760. read_cred_subscribers(tsk->cred) < 1 ||
  761. creds_are_invalid(tsk->real_cred) ||
  762. creds_are_invalid(tsk->cred)))
  763. goto invalid_creds;
  764. }
  765. return;
  766. invalid_creds:
  767. printk(KERN_ERR "CRED: Invalid process credentials\n");
  768. printk(KERN_ERR "CRED: At %s:%u\n", file, line);
  769. dump_invalid_creds(tsk->real_cred, "Real", tsk);
  770. if (tsk->cred != tsk->real_cred)
  771. dump_invalid_creds(tsk->cred, "Effective", tsk);
  772. else
  773. printk(KERN_ERR "CRED: Effective creds == Real creds\n");
  774. BUG();
  775. }
  776. EXPORT_SYMBOL(__validate_process_creds);
  777. /*
  778. * check creds for do_exit()
  779. */
  780. void validate_creds_for_do_exit(struct task_struct *tsk)
  781. {
  782. kdebug("validate_creds_for_do_exit(%p,%p{%d,%d})",
  783. tsk->real_cred, tsk->cred,
  784. atomic_read(&tsk->cred->usage),
  785. read_cred_subscribers(tsk->cred));
  786. __validate_process_creds(tsk, __FILE__, __LINE__);
  787. }
  788. #endif /* CONFIG_DEBUG_CREDENTIALS */