cred.h 12.1 KB
Newer Older
1
/* Credentials management - see Documentation/security/credentials.txt
2 3 4 5 6 7 8 9 10 11 12 13 14
 *
 * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells (dhowells@redhat.com)
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public Licence
 * as published by the Free Software Foundation; either version
 * 2 of the Licence, or (at your option) any later version.
 */

#ifndef _LINUX_CRED_H
#define _LINUX_CRED_H

15
#include <linux/capability.h>
16
#include <linux/init.h>
17
#include <linux/key.h>
18
#include <linux/selinux.h>
19
#include <linux/atomic.h>
20
#include <linux/uidgid.h>
21 22 23

struct user_struct;
struct cred;
24
struct inode;
25 26 27 28 29

/*
 * COW Supplementary groups list
 */
#define NGROUPS_SMALL		32
30
#define NGROUPS_PER_BLOCK	((unsigned int)(PAGE_SIZE / sizeof(kgid_t)))
31 32 33 34 35

struct group_info {
	atomic_t	usage;
	int		ngroups;
	int		nblocks;
36 37
	kgid_t		small_block[NGROUPS_SMALL];
	kgid_t		*blocks[0];
38 39 40 41 42 43
};

/**
 * get_group_info - Get a reference to a group info structure
 * @group_info: The group info to reference
 *
44 45 46 47
 * This gets a reference to a set of supplementary groups.
 *
 * If the caller is accessing a task's credentials, they must hold the RCU read
 * lock when reading.
48
 */
49 50 51 52 53
static inline struct group_info *get_group_info(struct group_info *gi)
{
	atomic_inc(&gi->usage);
	return gi;
}
54 55 56 57 58 59 60 61 62 63 64

/**
 * put_group_info - Release a reference to a group info structure
 * @group_info: The group info to release
 */
#define put_group_info(group_info)			\
do {							\
	if (atomic_dec_and_test(&(group_info)->usage))	\
		groups_free(group_info);		\
} while (0)

65
extern struct group_info init_groups;
66 67
#ifdef CONFIG_MULTIUSER
extern struct group_info *groups_alloc(int);
68
extern void groups_free(struct group_info *);
69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85

extern int in_group_p(kgid_t);
extern int in_egroup_p(kgid_t);
#else
static inline void groups_free(struct group_info *group_info)
{
}

static inline int in_group_p(kgid_t grp)
{
        return 1;
}
static inline int in_egroup_p(kgid_t grp)
{
        return 1;
}
#endif
86
extern int set_current_groups(struct group_info *);
87
extern void set_groups(struct cred *, struct group_info *);
88
extern int groups_search(const struct group_info *, kgid_t);
89
extern bool may_setgroups(void);
90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119

/* access the groups "array" with this macro */
#define GROUP_AT(gi, i) \
	((gi)->blocks[(i) / NGROUPS_PER_BLOCK][(i) % NGROUPS_PER_BLOCK])

/*
 * The security context of a task
 *
 * The parts of the context break down into two categories:
 *
 *  (1) The objective context of a task.  These parts are used when some other
 *	task is attempting to affect this one.
 *
 *  (2) The subjective context.  These details are used when the task is acting
 *	upon another object, be that a file, a task, a key or whatever.
 *
 * Note that some members of this structure belong to both categories - the
 * LSM security pointer for instance.
 *
 * A task has two security pointers.  task->real_cred points to the objective
 * context that defines that task's actual details.  The objective part of this
 * context is used whenever that task is acted upon.
 *
 * task->cred points to the subjective context that defines the details of how
 * that task is going to act upon another object.  This may be overridden
 * temporarily to point to another security context, but normally points to the
 * same context as task->real_cred.
 */
struct cred {
	atomic_t	usage;
120 121 122 123 124 125 126
#ifdef CONFIG_DEBUG_CREDENTIALS
	atomic_t	subscribers;	/* number of processes subscribed */
	void		*put_addr;
	unsigned	magic;
#define CRED_MAGIC	0x43736564
#define CRED_MAGIC_DEAD	0x44656144
#endif
127 128 129 130 131 132 133 134
	kuid_t		uid;		/* real UID of the task */
	kgid_t		gid;		/* real GID of the task */
	kuid_t		suid;		/* saved UID of the task */
	kgid_t		sgid;		/* saved GID of the task */
	kuid_t		euid;		/* effective UID of the task */
	kgid_t		egid;		/* effective GID of the task */
	kuid_t		fsuid;		/* UID for VFS ops */
	kgid_t		fsgid;		/* GID for VFS ops */
135 136 137 138 139
	unsigned	securebits;	/* SUID-less security management */
	kernel_cap_t	cap_inheritable; /* caps our children can inherit */
	kernel_cap_t	cap_permitted;	/* caps we're permitted */
	kernel_cap_t	cap_effective;	/* caps we can actually use */
	kernel_cap_t	cap_bset;	/* capability bounding set */
140
	kernel_cap_t	cap_ambient;	/* Ambient capability set */
141 142 143
#ifdef CONFIG_KEYS
	unsigned char	jit_keyring;	/* default keyring to attach requested
					 * keys to */
144 145
	struct key __rcu *session_keyring; /* keyring inherited over fork */
	struct key	*process_keyring; /* keyring private to this process */
146 147 148 149 150 151 152
	struct key	*thread_keyring; /* keyring private to this thread */
	struct key	*request_key_auth; /* assumed request_key authority */
#endif
#ifdef CONFIG_SECURITY
	void		*security;	/* subjective LSM security */
#endif
	struct user_struct *user;	/* real user ID subscription */
153
	struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
154 155 156 157
	struct group_info *group_info;	/* supplementary groups for euid/fsgid */
	struct rcu_head	rcu;		/* RCU deletion hook */
};

158
extern void __put_cred(struct cred *);
159
extern void exit_creds(struct task_struct *);
160
extern int copy_creds(struct task_struct *, unsigned long);
161
extern const struct cred *get_task_cred(struct task_struct *);
162
extern struct cred *cred_alloc_blank(void);
163
extern struct cred *prepare_creds(void);
164
extern struct cred *prepare_exec_creds(void);
165 166
extern int commit_creds(struct cred *);
extern void abort_creds(struct cred *);
167 168
extern const struct cred *override_creds(const struct cred *);
extern void revert_creds(const struct cred *);
169 170 171 172 173
extern struct cred *prepare_kernel_cred(struct task_struct *);
extern int change_create_files_as(struct cred *, struct inode *);
extern int set_security_override(struct cred *, u32);
extern int set_security_override_from_ctx(struct cred *, const char *);
extern int set_create_files_as(struct cred *, struct inode *);
174 175
extern void __init cred_init(void);

176 177 178 179 180 181 182 183
/*
 * check for validity of credentials
 */
#ifdef CONFIG_DEBUG_CREDENTIALS
extern void __invalid_creds(const struct cred *, const char *, unsigned);
extern void __validate_process_creds(struct task_struct *,
				     const char *, unsigned);

184
extern bool creds_are_invalid(const struct cred *cred);
185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215

static inline void __validate_creds(const struct cred *cred,
				    const char *file, unsigned line)
{
	if (unlikely(creds_are_invalid(cred)))
		__invalid_creds(cred, file, line);
}

#define validate_creds(cred)				\
do {							\
	__validate_creds((cred), __FILE__, __LINE__);	\
} while(0)

#define validate_process_creds()				\
do {								\
	__validate_process_creds(current, __FILE__, __LINE__);	\
} while(0)

extern void validate_creds_for_do_exit(struct task_struct *);
#else
static inline void validate_creds(const struct cred *cred)
{
}
static inline void validate_creds_for_do_exit(struct task_struct *tsk)
{
}
static inline void validate_process_creds(void)
{
}
#endif

216 217 218 219 220 221 222
static inline bool cap_ambient_invariant_ok(const struct cred *cred)
{
	return cap_issubset(cred->cap_ambient,
			    cap_intersect(cred->cap_permitted,
					  cred->cap_inheritable));
}

223 224 225 226 227 228 229 230 231 232 233 234
/**
 * get_new_cred - Get a reference on a new set of credentials
 * @cred: The new credentials to reference
 *
 * Get a reference on the specified set of new credentials.  The caller must
 * release the reference.
 */
static inline struct cred *get_new_cred(struct cred *cred)
{
	atomic_inc(&cred->usage);
	return cred;
}
235 236 237 238 239 240 241

/**
 * get_cred - Get a reference on a set of credentials
 * @cred: The credentials to reference
 *
 * Get a reference on the specified set of credentials.  The caller must
 * release the reference.
David Howells's avatar
David Howells committed
242 243 244 245 246 247
 *
 * This is used to deal with a committed set of credentials.  Although the
 * pointer is const, this will temporarily discard the const and increment the
 * usage count.  The purpose of this is to attempt to catch at compile time the
 * accidental alteration of a set of credentials that should be considered
 * immutable.
248
 */
249
static inline const struct cred *get_cred(const struct cred *cred)
250
{
251
	struct cred *nonconst_cred = (struct cred *) cred;
252
	validate_creds(cred);
253
	return get_new_cred(nonconst_cred);
254 255 256 257 258 259 260 261
}

/**
 * put_cred - Release a reference to a set of credentials
 * @cred: The credentials to release
 *
 * Release a reference to a set of credentials, deleting them when the last ref
 * is released.
David Howells's avatar
David Howells committed
262 263 264 265
 *
 * This takes a const pointer to a set of credentials because the credentials
 * on task_struct are attached by const pointers to prevent accidental
 * alteration of otherwise immutable credential sets.
266
 */
267
static inline void put_cred(const struct cred *_cred)
268
{
269
	struct cred *cred = (struct cred *) _cred;
270

271
	validate_creds(cred);
272 273 274 275
	if (atomic_dec_and_test(&(cred)->usage))
		__put_cred(cred);
}

276
/**
277
 * current_cred - Access the current task's subjective credentials
278
 *
279 280
 * Access the subjective credentials of the current task.  RCU-safe,
 * since nobody else can modify it.
281 282
 */
#define current_cred() \
283
	rcu_dereference_protected(current->cred, 1)
284

285 286 287 288 289 290 291 292 293
/**
 * current_real_cred - Access the current task's objective credentials
 *
 * Access the objective credentials of the current task.  RCU-safe,
 * since nobody else can modify it.
 */
#define current_real_cred() \
	rcu_dereference_protected(current->real_cred, 1)

294
/**
295
 * __task_cred - Access a task's objective credentials
296 297
 * @task: The task to query
 *
298
 * Access the objective credentials of a task.  The caller must hold the RCU
299
 * readlock.
300
 *
301 302
 * The result of this function should not be passed directly to get_cred();
 * rather get_task_cred() should be used instead.
303
 */
304 305
#define __task_cred(task)	\
	rcu_dereference((task)->real_cred)
306 307

/**
308
 * get_current_cred - Get the current task's subjective credentials
309
 *
310 311 312
 * Get the subjective credentials of the current task, pinning them so that
 * they can't go away.  Accessing the current task's credentials directly is
 * not permitted.
313 314 315 316 317 318 319 320 321 322 323 324 325
 */
#define get_current_cred()				\
	(get_cred(current_cred()))

/**
 * get_current_user - Get the current task's user_struct
 *
 * Get the user record of the current task, pinning it so that it can't go
 * away.
 */
#define get_current_user()				\
({							\
	struct user_struct *__u;			\
326
	const struct cred *__cred;			\
327
	__cred = current_cred();			\
328 329 330 331 332 333 334 335 336 337 338 339 340
	__u = get_uid(__cred->user);			\
	__u;						\
})

/**
 * get_current_groups - Get the current task's supplementary group list
 *
 * Get the supplementary group list of the current task, pinning it so that it
 * can't go away.
 */
#define get_current_groups()				\
({							\
	struct group_info *__groups;			\
341
	const struct cred *__cred;			\
342
	__cred = current_cred();			\
343 344 345 346
	__groups = get_group_info(__cred->group_info);	\
	__groups;					\
})

347 348 349 350 351 352 353
#define task_cred_xxx(task, xxx)			\
({							\
	__typeof__(((struct cred *)NULL)->xxx) ___val;	\
	rcu_read_lock();				\
	___val = __task_cred((task))->xxx;		\
	rcu_read_unlock();				\
	___val;						\
354 355 356 357 358 359 360
})

#define task_uid(task)		(task_cred_xxx((task), uid))
#define task_euid(task)		(task_cred_xxx((task), euid))

#define current_cred_xxx(xxx)			\
({						\
361
	current_cred()->xxx;			\
362 363 364 365 366 367 368 369 370 371 372 373 374 375
})

#define current_uid()		(current_cred_xxx(uid))
#define current_gid()		(current_cred_xxx(gid))
#define current_euid()		(current_cred_xxx(euid))
#define current_egid()		(current_cred_xxx(egid))
#define current_suid()		(current_cred_xxx(suid))
#define current_sgid()		(current_cred_xxx(sgid))
#define current_fsuid() 	(current_cred_xxx(fsuid))
#define current_fsgid() 	(current_cred_xxx(fsgid))
#define current_cap()		(current_cred_xxx(cap_effective))
#define current_user()		(current_cred_xxx(user))
#define current_security()	(current_cred_xxx(security))

376
extern struct user_namespace init_user_ns;
377
#ifdef CONFIG_USER_NS
378
#define current_user_ns()	(current_cred_xxx(user_ns))
379
#else
380 381 382 383
static inline struct user_namespace *current_user_ns(void)
{
	return &init_user_ns;
}
384 385
#endif

386

387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410
#define current_uid_gid(_uid, _gid)		\
do {						\
	const struct cred *__cred;		\
	__cred = current_cred();		\
	*(_uid) = __cred->uid;			\
	*(_gid) = __cred->gid;			\
} while(0)

#define current_euid_egid(_euid, _egid)		\
do {						\
	const struct cred *__cred;		\
	__cred = current_cred();		\
	*(_euid) = __cred->euid;		\
	*(_egid) = __cred->egid;		\
} while(0)

#define current_fsuid_fsgid(_fsuid, _fsgid)	\
do {						\
	const struct cred *__cred;		\
	__cred = current_cred();		\
	*(_fsuid) = __cred->fsuid;		\
	*(_fsgid) = __cred->fsgid;		\
} while(0)

411
#endif /* _LINUX_CRED_H */