1 /* SPDX-License-Identifier: GPL-2.0-or-later */ 2 /* Credentials management - see Documentation/security/credentials.rst 3 * 4 * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved. 5 * Written by David Howells (dhowells@redhat.com) 6 */ 7 8 #ifndef _LINUX_CRED_H 9 #define _LINUX_CRED_H 10 11 #include <linux/capability.h> 12 #include <linux/init.h> 13 #include <linux/key.h> 14 #include <linux/atomic.h> 15 #include <linux/uidgid.h> 16 #include <linux/sched.h> 17 #include <linux/sched/user.h> 18 19 struct cred; 20 struct inode; 21 22 /* 23 * COW Supplementary groups list 24 */ 25 struct group_info { 26 atomic_t usage; 27 int ngroups; 28 kgid_t gid[0]; 29 } __randomize_layout; 30 31 /** 32 * get_group_info - Get a reference to a group info structure 33 * @group_info: The group info to reference 34 * 35 * This gets a reference to a set of supplementary groups. 36 * 37 * If the caller is accessing a task's credentials, they must hold the RCU read 38 * lock when reading. 39 */ 40 static inline struct group_info *get_group_info(struct group_info *gi) 41 { 42 atomic_inc(&gi->usage); 43 return gi; 44 } 45 46 /** 47 * put_group_info - Release a reference to a group info structure 48 * @group_info: The group info to release 49 */ 50 #define put_group_info(group_info) \ 51 do { \ 52 if (atomic_dec_and_test(&(group_info)->usage)) \ 53 groups_free(group_info); \ 54 } while (0) 55 56 extern struct group_info init_groups; 57 #ifdef CONFIG_MULTIUSER 58 extern struct group_info *groups_alloc(int); 59 extern void groups_free(struct group_info *); 60 61 extern int in_group_p(kgid_t); 62 extern int in_egroup_p(kgid_t); 63 extern int groups_search(const struct group_info *, kgid_t); 64 65 extern int set_current_groups(struct group_info *); 66 extern void set_groups(struct cred *, struct group_info *); 67 extern bool may_setgroups(void); 68 extern void groups_sort(struct group_info *); 69 #else 70 static inline void groups_free(struct group_info *group_info) 71 { 72 } 73 74 static inline int in_group_p(kgid_t grp) 75 { 76 return 1; 77 } 78 static inline int in_egroup_p(kgid_t grp) 79 { 80 return 1; 81 } 82 static inline int groups_search(const struct group_info *group_info, kgid_t grp) 83 { 84 return 1; 85 } 86 #endif 87 88 /* 89 * The security context of a task 90 * 91 * The parts of the context break down into two categories: 92 * 93 * (1) The objective context of a task. These parts are used when some other 94 * task is attempting to affect this one. 95 * 96 * (2) The subjective context. These details are used when the task is acting 97 * upon another object, be that a file, a task, a key or whatever. 98 * 99 * Note that some members of this structure belong to both categories - the 100 * LSM security pointer for instance. 101 * 102 * A task has two security pointers. task->real_cred points to the objective 103 * context that defines that task's actual details. The objective part of this 104 * context is used whenever that task is acted upon. 105 * 106 * task->cred points to the subjective context that defines the details of how 107 * that task is going to act upon another object. This may be overridden 108 * temporarily to point to another security context, but normally points to the 109 * same context as task->real_cred. 110 */ 111 struct cred { 112 atomic_t usage; 113 #ifdef CONFIG_DEBUG_CREDENTIALS 114 atomic_t subscribers; /* number of processes subscribed */ 115 void *put_addr; 116 unsigned magic; 117 #define CRED_MAGIC 0x43736564 118 #define CRED_MAGIC_DEAD 0x44656144 119 #endif 120 kuid_t uid; /* real UID of the task */ 121 kgid_t gid; /* real GID of the task */ 122 kuid_t suid; /* saved UID of the task */ 123 kgid_t sgid; /* saved GID of the task */ 124 kuid_t euid; /* effective UID of the task */ 125 kgid_t egid; /* effective GID of the task */ 126 kuid_t fsuid; /* UID for VFS ops */ 127 kgid_t fsgid; /* GID for VFS ops */ 128 unsigned securebits; /* SUID-less security management */ 129 kernel_cap_t cap_inheritable; /* caps our children can inherit */ 130 kernel_cap_t cap_permitted; /* caps we're permitted */ 131 kernel_cap_t cap_effective; /* caps we can actually use */ 132 kernel_cap_t cap_bset; /* capability bounding set */ 133 kernel_cap_t cap_ambient; /* Ambient capability set */ 134 #ifdef CONFIG_KEYS 135 unsigned char jit_keyring; /* default keyring to attach requested 136 * keys to */ 137 struct key *session_keyring; /* keyring inherited over fork */ 138 struct key *process_keyring; /* keyring private to this process */ 139 struct key *thread_keyring; /* keyring private to this thread */ 140 struct key *request_key_auth; /* assumed request_key authority */ 141 #endif 142 #ifdef CONFIG_SECURITY 143 void *security; /* subjective LSM security */ 144 #endif 145 struct user_struct *user; /* real user ID subscription */ 146 struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */ 147 struct group_info *group_info; /* supplementary groups for euid/fsgid */ 148 struct rcu_head rcu; /* RCU deletion hook */ 149 } __randomize_layout; 150 151 extern void __put_cred(struct cred *); 152 extern void exit_creds(struct task_struct *); 153 extern int copy_creds(struct task_struct *, unsigned long); 154 extern const struct cred *get_task_cred(struct task_struct *); 155 extern struct cred *cred_alloc_blank(void); 156 extern struct cred *prepare_creds(void); 157 extern struct cred *prepare_exec_creds(void); 158 extern int commit_creds(struct cred *); 159 extern void abort_creds(struct cred *); 160 extern const struct cred *override_creds(const struct cred *); 161 extern void revert_creds(const struct cred *); 162 extern struct cred *prepare_kernel_cred(struct task_struct *); 163 extern int change_create_files_as(struct cred *, struct inode *); 164 extern int set_security_override(struct cred *, u32); 165 extern int set_security_override_from_ctx(struct cred *, const char *); 166 extern int set_create_files_as(struct cred *, struct inode *); 167 extern int cred_fscmp(const struct cred *, const struct cred *); 168 extern void __init cred_init(void); 169 170 /* 171 * check for validity of credentials 172 */ 173 #ifdef CONFIG_DEBUG_CREDENTIALS 174 extern void __invalid_creds(const struct cred *, const char *, unsigned); 175 extern void __validate_process_creds(struct task_struct *, 176 const char *, unsigned); 177 178 extern bool creds_are_invalid(const struct cred *cred); 179 180 static inline void __validate_creds(const struct cred *cred, 181 const char *file, unsigned line) 182 { 183 if (unlikely(creds_are_invalid(cred))) 184 __invalid_creds(cred, file, line); 185 } 186 187 #define validate_creds(cred) \ 188 do { \ 189 __validate_creds((cred), __FILE__, __LINE__); \ 190 } while(0) 191 192 #define validate_process_creds() \ 193 do { \ 194 __validate_process_creds(current, __FILE__, __LINE__); \ 195 } while(0) 196 197 extern void validate_creds_for_do_exit(struct task_struct *); 198 #else 199 static inline void validate_creds(const struct cred *cred) 200 { 201 } 202 static inline void validate_creds_for_do_exit(struct task_struct *tsk) 203 { 204 } 205 static inline void validate_process_creds(void) 206 { 207 } 208 #endif 209 210 static inline bool cap_ambient_invariant_ok(const struct cred *cred) 211 { 212 return cap_issubset(cred->cap_ambient, 213 cap_intersect(cred->cap_permitted, 214 cred->cap_inheritable)); 215 } 216 217 /** 218 * get_new_cred - Get a reference on a new set of credentials 219 * @cred: The new credentials to reference 220 * 221 * Get a reference on the specified set of new credentials. The caller must 222 * release the reference. 223 */ 224 static inline struct cred *get_new_cred(struct cred *cred) 225 { 226 atomic_inc(&cred->usage); 227 return cred; 228 } 229 230 /** 231 * get_cred - Get a reference on a set of credentials 232 * @cred: The credentials to reference 233 * 234 * Get a reference on the specified set of credentials. The caller must 235 * release the reference. If %NULL is passed, it is returned with no action. 236 * 237 * This is used to deal with a committed set of credentials. Although the 238 * pointer is const, this will temporarily discard the const and increment the 239 * usage count. The purpose of this is to attempt to catch at compile time the 240 * accidental alteration of a set of credentials that should be considered 241 * immutable. 242 */ 243 static inline const struct cred *get_cred(const struct cred *cred) 244 { 245 struct cred *nonconst_cred = (struct cred *) cred; 246 if (!cred) 247 return cred; 248 validate_creds(cred); 249 return get_new_cred(nonconst_cred); 250 } 251 252 static inline const struct cred *get_cred_rcu(const struct cred *cred) 253 { 254 struct cred *nonconst_cred = (struct cred *) cred; 255 if (!cred) 256 return NULL; 257 if (!atomic_inc_not_zero(&nonconst_cred->usage)) 258 return NULL; 259 validate_creds(cred); 260 return cred; 261 } 262 263 /** 264 * put_cred - Release a reference to a set of credentials 265 * @cred: The credentials to release 266 * 267 * Release a reference to a set of credentials, deleting them when the last ref 268 * is released. If %NULL is passed, nothing is done. 269 * 270 * This takes a const pointer to a set of credentials because the credentials 271 * on task_struct are attached by const pointers to prevent accidental 272 * alteration of otherwise immutable credential sets. 273 */ 274 static inline void put_cred(const struct cred *_cred) 275 { 276 struct cred *cred = (struct cred *) _cred; 277 278 if (cred) { 279 validate_creds(cred); 280 if (atomic_dec_and_test(&(cred)->usage)) 281 __put_cred(cred); 282 } 283 } 284 285 /** 286 * current_cred - Access the current task's subjective credentials 287 * 288 * Access the subjective credentials of the current task. RCU-safe, 289 * since nobody else can modify it. 290 */ 291 #define current_cred() \ 292 rcu_dereference_protected(current->cred, 1) 293 294 /** 295 * current_real_cred - Access the current task's objective credentials 296 * 297 * Access the objective credentials of the current task. RCU-safe, 298 * since nobody else can modify it. 299 */ 300 #define current_real_cred() \ 301 rcu_dereference_protected(current->real_cred, 1) 302 303 /** 304 * __task_cred - Access a task's objective credentials 305 * @task: The task to query 306 * 307 * Access the objective credentials of a task. The caller must hold the RCU 308 * readlock. 309 * 310 * The result of this function should not be passed directly to get_cred(); 311 * rather get_task_cred() should be used instead. 312 */ 313 #define __task_cred(task) \ 314 rcu_dereference((task)->real_cred) 315 316 /** 317 * get_current_cred - Get the current task's subjective credentials 318 * 319 * Get the subjective credentials of the current task, pinning them so that 320 * they can't go away. Accessing the current task's credentials directly is 321 * not permitted. 322 */ 323 #define get_current_cred() \ 324 (get_cred(current_cred())) 325 326 /** 327 * get_current_user - Get the current task's user_struct 328 * 329 * Get the user record of the current task, pinning it so that it can't go 330 * away. 331 */ 332 #define get_current_user() \ 333 ({ \ 334 struct user_struct *__u; \ 335 const struct cred *__cred; \ 336 __cred = current_cred(); \ 337 __u = get_uid(__cred->user); \ 338 __u; \ 339 }) 340 341 /** 342 * get_current_groups - Get the current task's supplementary group list 343 * 344 * Get the supplementary group list of the current task, pinning it so that it 345 * can't go away. 346 */ 347 #define get_current_groups() \ 348 ({ \ 349 struct group_info *__groups; \ 350 const struct cred *__cred; \ 351 __cred = current_cred(); \ 352 __groups = get_group_info(__cred->group_info); \ 353 __groups; \ 354 }) 355 356 #define task_cred_xxx(task, xxx) \ 357 ({ \ 358 __typeof__(((struct cred *)NULL)->xxx) ___val; \ 359 rcu_read_lock(); \ 360 ___val = __task_cred((task))->xxx; \ 361 rcu_read_unlock(); \ 362 ___val; \ 363 }) 364 365 #define task_uid(task) (task_cred_xxx((task), uid)) 366 #define task_euid(task) (task_cred_xxx((task), euid)) 367 368 #define current_cred_xxx(xxx) \ 369 ({ \ 370 current_cred()->xxx; \ 371 }) 372 373 #define current_uid() (current_cred_xxx(uid)) 374 #define current_gid() (current_cred_xxx(gid)) 375 #define current_euid() (current_cred_xxx(euid)) 376 #define current_egid() (current_cred_xxx(egid)) 377 #define current_suid() (current_cred_xxx(suid)) 378 #define current_sgid() (current_cred_xxx(sgid)) 379 #define current_fsuid() (current_cred_xxx(fsuid)) 380 #define current_fsgid() (current_cred_xxx(fsgid)) 381 #define current_cap() (current_cred_xxx(cap_effective)) 382 #define current_user() (current_cred_xxx(user)) 383 #define current_security() (current_cred_xxx(security)) 384 385 extern struct user_namespace init_user_ns; 386 #ifdef CONFIG_USER_NS 387 #define current_user_ns() (current_cred_xxx(user_ns)) 388 #else 389 static inline struct user_namespace *current_user_ns(void) 390 { 391 return &init_user_ns; 392 } 393 #endif 394 395 396 #define current_uid_gid(_uid, _gid) \ 397 do { \ 398 const struct cred *__cred; \ 399 __cred = current_cred(); \ 400 *(_uid) = __cred->uid; \ 401 *(_gid) = __cred->gid; \ 402 } while(0) 403 404 #define current_euid_egid(_euid, _egid) \ 405 do { \ 406 const struct cred *__cred; \ 407 __cred = current_cred(); \ 408 *(_euid) = __cred->euid; \ 409 *(_egid) = __cred->egid; \ 410 } while(0) 411 412 #define current_fsuid_fsgid(_fsuid, _fsgid) \ 413 do { \ 414 const struct cred *__cred; \ 415 __cred = current_cred(); \ 416 *(_fsuid) = __cred->fsuid; \ 417 *(_fsgid) = __cred->fsgid; \ 418 } while(0) 419 420 #endif /* _LINUX_CRED_H */ 421