kernel/cred.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /* Task credentials management - see Documentation/security/credentials.rst
   3  *
   4  * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved.
   5  * Written by David Howells (dhowells@redhat.com)
   6  */
   7
   8 #define pr_fmt(fmt) "CRED: " fmt
   9
  10 #include <linux/export.h>
  11 #include <linux/cred.h>
  12 #include <linux/slab.h>
  13 #include <linux/sched.h>
  14 #include <linux/sched/coredump.h>
  15 #include <linux/key.h>
  16 #include <linux/keyctl.h>
  17 #include <linux/init_task.h>
  18 #include <linux/security.h>
  19 #include <linux/binfmts.h>
  20 #include <linux/cn_proc.h>
  21 #include <linux/uidgid.h>
  22
  23 #if 0
  24 #define kdebug(FMT, ...)                                                \
  25         printk("[%-5.5s%5u] " FMT "\n",                                 \
  26                current->comm, current->pid, ##__VA_ARGS__)
  27 #else
  28 #define kdebug(FMT, ...)                                                \
  29 do {                                                                    \
  30         if (0)                                                          \
  31                 no_printk("[%-5.5s%5u] " FMT "\n",                      \
  32                           current->comm, current->pid, ##__VA_ARGS__);  \
  33 } while (0)
  34 #endif
  35
  36 static struct kmem_cache *cred_jar;
  37
  38 /* init to 2 - one for init_task, one to ensure it is never freed */
  39 static struct group_info init_groups = { .usage = ATOMIC_INIT(2) };
  40
  41 /*
  42  * The initial credentials for the initial task
  43  */
  44 struct cred init_cred = {
  45         .usage                  = ATOMIC_INIT(4),
  46 #ifdef CONFIG_DEBUG_CREDENTIALS
  47         .subscribers            = ATOMIC_INIT(2),
  48         .magic                  = CRED_MAGIC,
  49 #endif
  50         .uid                    = GLOBAL_ROOT_UID,
  51         .gid                    = GLOBAL_ROOT_GID,
  52         .suid                   = GLOBAL_ROOT_UID,
  53         .sgid                   = GLOBAL_ROOT_GID,
  54         .euid                   = GLOBAL_ROOT_UID,
  55         .egid                   = GLOBAL_ROOT_GID,
  56         .fsuid                  = GLOBAL_ROOT_UID,
  57         .fsgid                  = GLOBAL_ROOT_GID,
  58         .securebits             = SECUREBITS_DEFAULT,
  59         .cap_inheritable        = CAP_EMPTY_SET,
  60         .cap_permitted          = CAP_FULL_SET,
  61         .cap_effective          = CAP_FULL_SET,
  62         .cap_bset               = CAP_FULL_SET,
  63         .user                   = INIT_USER,
  64         .user_ns                = &init_user_ns,
  65         .group_info             = &init_groups,
  66         .ucounts                = &init_ucounts,
  67 };
  68
  69 static inline void set_cred_subscribers(struct cred *cred, int n)
  70 {
  71 #ifdef CONFIG_DEBUG_CREDENTIALS
  72         atomic_set(&cred->subscribers, n);
  73 #endif
  74 }
  75
  76 static inline int read_cred_subscribers(const struct cred *cred)
  77 {
  78 #ifdef CONFIG_DEBUG_CREDENTIALS
  79         return atomic_read(&cred->subscribers);
  80 #else
  81         return 0;
  82 #endif
  83 }
  84
  85 static inline void alter_cred_subscribers(const struct cred *_cred, int n)
  86 {
  87 #ifdef CONFIG_DEBUG_CREDENTIALS
  88         struct cred *cred = (struct cred *) _cred;
  89
  90         atomic_add(n, &cred->subscribers);
  91 #endif
  92 }
  93
  94 /*
  95  * The RCU callback to actually dispose of a set of credentials
  96  */
  97 static void put_cred_rcu(struct rcu_head *rcu)
  98 {
  99         struct cred *cred = container_of(rcu, struct cred, rcu);
 100
 101         kdebug("put_cred_rcu(%p)", cred);
 102
 103 #ifdef CONFIG_DEBUG_CREDENTIALS
 104         if (cred->magic != CRED_MAGIC_DEAD ||
 105             atomic_read(&cred->usage) != 0 ||
 106             read_cred_subscribers(cred) != 0)
 107                 panic("CRED: put_cred_rcu() sees %p with"
 108                       " mag %x, put %p, usage %d, subscr %d\n",
 109                       cred, cred->magic, cred->put_addr,
 110                       atomic_read(&cred->usage),
 111                       read_cred_subscribers(cred));
 112 #else
 113         if (atomic_read(&cred->usage) != 0)
 114                 panic("CRED: put_cred_rcu() sees %p with usage %d\n",
 115                       cred, atomic_read(&cred->usage));
 116 #endif
 117
 118         security_cred_free(cred);
 119         key_put(cred->session_keyring);
 120         key_put(cred->process_keyring);
 121         key_put(cred->thread_keyring);
 122         key_put(cred->request_key_auth);
 123         if (cred->group_info)
 124                 put_group_info(cred->group_info);
 125         free_uid(cred->user);
 126         if (cred->ucounts)
 127                 put_ucounts(cred->ucounts);
 128         put_user_ns(cred->user_ns);
 129         kmem_cache_free(cred_jar, cred);
 130 }
 131
 132 /**
 133  * __put_cred - Destroy a set of credentials
 134  * @cred: The record to release
 135  *
 136  * Destroy a set of credentials on which no references remain.
 137  */
 138 void __put_cred(struct cred *cred)
 139 {
 140         kdebug("__put_cred(%p{%d,%d})", cred,
 141                atomic_read(&cred->usage),
 142                read_cred_subscribers(cred));
 143
 144         BUG_ON(atomic_read(&cred->usage) != 0);
 145 #ifdef CONFIG_DEBUG_CREDENTIALS
 146         BUG_ON(read_cred_subscribers(cred) != 0);
 147         cred->magic = CRED_MAGIC_DEAD;
 148         cred->put_addr = __builtin_return_address(0);
 149 #endif
 150         BUG_ON(cred == current->cred);
 151         BUG_ON(cred == current->real_cred);
 152
 153         if (cred->non_rcu)
 154                 put_cred_rcu(&cred->rcu);
 155         else
 156                 call_rcu(&cred->rcu, put_cred_rcu);
 157 }
 158 EXPORT_SYMBOL(__put_cred);
 159
 160 /*
 161  * Clean up a task's credentials when it exits
 162  */
 163 void exit_creds(struct task_struct *tsk)
 164 {
 165         struct cred *cred;
 166
 167         kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
 168                atomic_read(&tsk->cred->usage),
 169                read_cred_subscribers(tsk->cred));
 170
 171         cred = (struct cred *) tsk->real_cred;
 172         tsk->real_cred = NULL;
 173         validate_creds(cred);
 174         alter_cred_subscribers(cred, -1);
 175         put_cred(cred);
 176
 177         cred = (struct cred *) tsk->cred;
 178         tsk->cred = NULL;
 179         validate_creds(cred);
 180         alter_cred_subscribers(cred, -1);
 181         put_cred(cred);
 182
 183 #ifdef CONFIG_KEYS_REQUEST_CACHE
 184         key_put(tsk->cached_requested_key);
 185         tsk->cached_requested_key = NULL;
 186 #endif
 187 }
 188
 189 /**
 190  * get_task_cred - Get another task's objective credentials
 191  * @task: The task to query
 192  *
 193  * Get the objective credentials of a task, pinning them so that they can't go
 194  * away.  Accessing a task's credentials directly is not permitted.
 195  *
 196  * The caller must also make sure task doesn't get deleted, either by holding a
 197  * ref on task or by holding tasklist_lock to prevent it from being unlinked.
 198  */
 199 const struct cred *get_task_cred(struct task_struct *task)
 200 {
 201         const struct cred *cred;
 202
 203         rcu_read_lock();
 204
 205         do {
 206                 cred = __task_cred((task));
 207                 BUG_ON(!cred);
 208         } while (!get_cred_rcu(cred));
 209
 210         rcu_read_unlock();
 211         return cred;
 212 }
 213 EXPORT_SYMBOL(get_task_cred);
 214
 215 /*
 216  * Allocate blank credentials, such that the credentials can be filled in at a
 217  * later date without risk of ENOMEM.
 218  */
 219 struct cred *cred_alloc_blank(void)
 220 {
 221         struct cred *new;
 222
 223         new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
 224         if (!new)
 225                 return NULL;
 226
 227         atomic_set(&new->usage, 1);
 228 #ifdef CONFIG_DEBUG_CREDENTIALS
 229         new->magic = CRED_MAGIC;
 230 #endif
 231         if (security_cred_alloc_blank(new, GFP_KERNEL_ACCOUNT) < 0)
 232                 goto error;
 233
 234         return new;
 235
 236 error:
 237         abort_creds(new);
 238         return NULL;
 239 }
 240
 241 /**
 242  * prepare_creds - Prepare a new set of credentials for modification
 243  *
 244  * Prepare a new set of task credentials for modification.  A task's creds
 245  * shouldn't generally be modified directly, therefore this function is used to
 246  * prepare a new copy, which the caller then modifies and then commits by
 247  * calling commit_creds().
 248  *
 249  * Preparation involves making a copy of the objective creds for modification.
 250  *
 251  * Returns a pointer to the new creds-to-be if successful, NULL otherwise.
 252  *
 253  * Call commit_creds() or abort_creds() to clean up.
 254  */
 255 struct cred *prepare_creds(void)
 256 {
 257         struct task_struct *task = current;
 258         const struct cred *old;
 259         struct cred *new;
 260
 261         validate_process_creds();
 262
 263         new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
 264         if (!new)
 265                 return NULL;
 266
 267         kdebug("prepare_creds() alloc %p", new);
 268
 269         old = task->cred;
 270         memcpy(new, old, sizeof(struct cred));
 271
 272         new->non_rcu = 0;
 273         atomic_set(&new->usage, 1);
 274         set_cred_subscribers(new, 0);
 275         get_group_info(new->group_info);
 276         get_uid(new->user);
 277         get_user_ns(new->user_ns);
 278
 279 #ifdef CONFIG_KEYS
 280         key_get(new->session_keyring);
 281         key_get(new->process_keyring);
 282         key_get(new->thread_keyring);
 283         key_get(new->request_key_auth);
 284 #endif
 285
 286 #ifdef CONFIG_SECURITY
 287         new->security = NULL;
 288 #endif
 289
 290         new->ucounts = get_ucounts(new->ucounts);
 291         if (!new->ucounts)
 292                 goto error;
 293
 294         if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
 295                 goto error;
 296
 297         validate_creds(new);
 298         return new;
 299
 300 error:
 301         abort_creds(new);
 302         return NULL;
 303 }
 304 EXPORT_SYMBOL(prepare_creds);
 305
 306 /*
 307  * Prepare credentials for current to perform an execve()
 308  * - The caller must hold ->cred_guard_mutex
 309  */
 310 struct cred *prepare_exec_creds(void)
 311 {
 312         struct cred *new;
 313
 314         new = prepare_creds();
 315         if (!new)
 316                 return new;
 317
 318 #ifdef CONFIG_KEYS
 319         /* newly exec'd tasks don't get a thread keyring */
 320         key_put(new->thread_keyring);
 321         new->thread_keyring = NULL;
 322
 323         /* inherit the session keyring; new process keyring */
 324         key_put(new->process_keyring);
 325         new->process_keyring = NULL;
 326 #endif
 327
 328         new->suid = new->fsuid = new->euid;
 329         new->sgid = new->fsgid = new->egid;
 330
 331         return new;
 332 }
 333
 334 /*
 335  * Copy credentials for the new process created by fork()
 336  *
 337  * We share if we can, but under some circumstances we have to generate a new
 338  * set.
 339  *
 340  * The new process gets the current process's subjective credentials as its
 341  * objective and subjective credentials
 342  */
 343 int copy_creds(struct task_struct *p, unsigned long clone_flags)
 344 {
 345         struct cred *new;
 346         int ret;
 347
 348 #ifdef CONFIG_KEYS_REQUEST_CACHE
 349         p->cached_requested_key = NULL;
 350 #endif
 351
 352         if (
 353 #ifdef CONFIG_KEYS
 354                 !p->cred->thread_keyring &&
 355 #endif
 356                 clone_flags & CLONE_THREAD
 357             ) {
 358                 p->real_cred = get_cred(p->cred);
 359                 get_cred(p->cred);
 360                 alter_cred_subscribers(p->cred, 2);
 361                 kdebug("share_creds(%p{%d,%d})",
 362                        p->cred, atomic_read(&p->cred->usage),
 363                        read_cred_subscribers(p->cred));
 364                 inc_rlimit_ucounts(task_ucounts(p), UCOUNT_RLIMIT_NPROC, 1);
 365                 return 0;
 366         }
 367
 368         new = prepare_creds();
 369         if (!new)
 370                 return -ENOMEM;
 371
 372         if (clone_flags & CLONE_NEWUSER) {
 373                 ret = create_user_ns(new);
 374                 if (ret < 0)
 375                         goto error_put;
 376                 ret = set_cred_ucounts(new);
 377                 if (ret < 0)
 378                         goto error_put;
 379         }
 380
 381 #ifdef CONFIG_KEYS
 382         /* new threads get their own thread keyrings if their parent already
 383          * had one */
 384         if (new->thread_keyring) {
 385                 key_put(new->thread_keyring);
 386                 new->thread_keyring = NULL;
 387                 if (clone_flags & CLONE_THREAD)
 388                         install_thread_keyring_to_cred(new);
 389         }
 390
 391         /* The process keyring is only shared between the threads in a process;
 392          * anything outside of those threads doesn't inherit.
 393          */
 394         if (!(clone_flags & CLONE_THREAD)) {
 395                 key_put(new->process_keyring);
 396                 new->process_keyring = NULL;
 397         }
 398 #endif
 399
 400         p->cred = p->real_cred = get_cred(new);
 401         inc_rlimit_ucounts(task_ucounts(p), UCOUNT_RLIMIT_NPROC, 1);
 402         alter_cred_subscribers(new, 2);
 403         validate_creds(new);
 404         return 0;
 405
 406 error_put:
 407         put_cred(new);
 408         return ret;
 409 }
 410
 411 static bool cred_cap_issubset(const struct cred *set, const struct cred *subset)
 412 {
 413         const struct user_namespace *set_ns = set->user_ns;
 414         const struct user_namespace *subset_ns = subset->user_ns;
 415
 416         /* If the two credentials are in the same user namespace see if
 417          * the capabilities of subset are a subset of set.
 418          */
 419         if (set_ns == subset_ns)
 420                 return cap_issubset(subset->cap_permitted, set->cap_permitted);
 421
 422         /* The credentials are in a different user namespaces
 423          * therefore one is a subset of the other only if a set is an
 424          * ancestor of subset and set->euid is owner of subset or one
 425          * of subsets ancestors.
 426          */
 427         for (;subset_ns != &init_user_ns; subset_ns = subset_ns->parent) {
 428                 if ((set_ns == subset_ns->parent)  &&
 429                     uid_eq(subset_ns->owner, set->euid))
 430                         return true;
 431         }
 432
 433         return false;
 434 }
 435
 436 /**
 437  * commit_creds - Install new credentials upon the current task
 438  * @new: The credentials to be assigned
 439  *
 440  * Install a new set of credentials to the current task, using RCU to replace
 441  * the old set.  Both the objective and the subjective credentials pointers are
 442  * updated.  This function may not be called if the subjective credentials are
 443  * in an overridden state.
 444  *
 445  * This function eats the caller's reference to the new credentials.
 446  *
 447  * Always returns 0 thus allowing this function to be tail-called at the end
 448  * of, say, sys_setgid().
 449  */
 450 int commit_creds(struct cred *new)
 451 {
 452         struct task_struct *task = current;
 453         const struct cred *old = task->real_cred;
 454
 455         kdebug("commit_creds(%p{%d,%d})", new,
 456                atomic_read(&new->usage),
 457                read_cred_subscribers(new));
 458
 459         BUG_ON(task->cred != old);
 460 #ifdef CONFIG_DEBUG_CREDENTIALS
 461         BUG_ON(read_cred_subscribers(old) < 2);
 462         validate_creds(old);
 463         validate_creds(new);
 464 #endif
 465         BUG_ON(atomic_read(&new->usage) < 1);
 466
 467         get_cred(new); /* we will require a ref for the subj creds too */
 468
 469         /* dumpability changes */
 470         if (!uid_eq(old->euid, new->euid) ||
 471             !gid_eq(old->egid, new->egid) ||
 472             !uid_eq(old->fsuid, new->fsuid) ||
 473             !gid_eq(old->fsgid, new->fsgid) ||
 474             !cred_cap_issubset(old, new)) {
 475                 if (task->mm)
 476                         set_dumpable(task->mm, suid_dumpable);
 477                 task->pdeath_signal = 0;
 478                 /*
 479                  * If a task drops privileges and becomes nondumpable,
 480                  * the dumpability change must become visible before
 481                  * the credential change; otherwise, a __ptrace_may_access()
 482                  * racing with this change may be able to attach to a task it
 483                  * shouldn't be able to attach to (as if the task had dropped
 484                  * privileges without becoming nondumpable).
 485                  * Pairs with a read barrier in __ptrace_may_access().
 486                  */
 487                 smp_wmb();
 488         }
 489
 490         /* alter the thread keyring */
 491         if (!uid_eq(new->fsuid, old->fsuid))
 492                 key_fsuid_changed(new);
 493         if (!gid_eq(new->fsgid, old->fsgid))
 494                 key_fsgid_changed(new);
 495
 496         /* do it
 497          * RLIMIT_NPROC limits on user->processes have already been checked
 498          * in set_user().
 499          */
 500         alter_cred_subscribers(new, 2);
 501         if (new->user != old->user || new->user_ns != old->user_ns)
 502                 inc_rlimit_ucounts(new->ucounts, UCOUNT_RLIMIT_NPROC, 1);
 503         rcu_assign_pointer(task->real_cred, new);
 504         rcu_assign_pointer(task->cred, new);
 505         if (new->user != old->user || new->user_ns != old->user_ns)
 506                 dec_rlimit_ucounts(old->ucounts, UCOUNT_RLIMIT_NPROC, 1);
 507         alter_cred_subscribers(old, -2);
 508
 509         /* send notifications */
 510         if (!uid_eq(new->uid,   old->uid)  ||
 511             !uid_eq(new->euid,  old->euid) ||
 512             !uid_eq(new->suid,  old->suid) ||
 513             !uid_eq(new->fsuid, old->fsuid))
 514                 proc_id_connector(task, PROC_EVENT_UID);
 515
 516         if (!gid_eq(new->gid,   old->gid)  ||
 517             !gid_eq(new->egid,  old->egid) ||
 518             !gid_eq(new->sgid,  old->sgid) ||
 519             !gid_eq(new->fsgid, old->fsgid))
 520                 proc_id_connector(task, PROC_EVENT_GID);
 521
 522         /* release the old obj and subj refs both */
 523         put_cred(old);
 524         put_cred(old);
 525         return 0;
 526 }
 527 EXPORT_SYMBOL(commit_creds);
 528
 529 /**
 530  * abort_creds - Discard a set of credentials and unlock the current task
 531  * @new: The credentials that were going to be applied
 532  *
 533  * Discard a set of credentials that were under construction and unlock the
 534  * current task.
 535  */
 536 void abort_creds(struct cred *new)
 537 {
 538         kdebug("abort_creds(%p{%d,%d})", new,
 539                atomic_read(&new->usage),
 540                read_cred_subscribers(new));
 541
 542 #ifdef CONFIG_DEBUG_CREDENTIALS
 543         BUG_ON(read_cred_subscribers(new) != 0);
 544 #endif
 545         BUG_ON(atomic_read(&new->usage) < 1);
 546         put_cred(new);
 547 }
 548 EXPORT_SYMBOL(abort_creds);
 549
 550 /**
 551  * override_creds - Override the current process's subjective credentials
 552  * @new: The credentials to be assigned
 553  *
 554  * Install a set of temporary override subjective credentials on the current
 555  * process, returning the old set for later reversion.
 556  */
 557 const struct cred *override_creds(const struct cred *new)
 558 {
 559         const struct cred *old = current->cred;
 560
 561         kdebug("override_creds(%p{%d,%d})", new,
 562                atomic_read(&new->usage),
 563                read_cred_subscribers(new));
 564
 565         validate_creds(old);
 566         validate_creds(new);
 567
 568         /*
 569          * NOTE! This uses 'get_new_cred()' rather than 'get_cred()'.
 570          *
 571          * That means that we do not clear the 'non_rcu' flag, since
 572          * we are only installing the cred into the thread-synchronous
 573          * '->cred' pointer, not the '->real_cred' pointer that is
 574          * visible to other threads under RCU.
 575          *
 576          * Also note that we did validate_creds() manually, not depending
 577          * on the validation in 'get_cred()'.
 578          */
 579         get_new_cred((struct cred *)new);
 580         alter_cred_subscribers(new, 1);
 581         rcu_assign_pointer(current->cred, new);
 582         alter_cred_subscribers(old, -1);
 583
 584         kdebug("override_creds() = %p{%d,%d}", old,
 585                atomic_read(&old->usage),
 586                read_cred_subscribers(old));
 587         return old;
 588 }
 589 EXPORT_SYMBOL(override_creds);
 590
 591 /**
 592  * revert_creds - Revert a temporary subjective credentials override
 593  * @old: The credentials to be restored
 594  *
 595  * Revert a temporary set of override subjective credentials to an old set,
 596  * discarding the override set.
 597  */
 598 void revert_creds(const struct cred *old)
 599 {
 600         const struct cred *override = current->cred;
 601
 602         kdebug("revert_creds(%p{%d,%d})", old,
 603                atomic_read(&old->usage),
 604                read_cred_subscribers(old));
 605
 606         validate_creds(old);
 607         validate_creds(override);
 608         alter_cred_subscribers(old, 1);
 609         rcu_assign_pointer(current->cred, old);
 610         alter_cred_subscribers(override, -1);
 611         put_cred(override);
 612 }
 613 EXPORT_SYMBOL(revert_creds);
 614
 615 /**
 616  * cred_fscmp - Compare two credentials with respect to filesystem access.
 617  * @a: The first credential
 618  * @b: The second credential
 619  *
 620  * cred_cmp() will return zero if both credentials have the same
 621  * fsuid, fsgid, and supplementary groups.  That is, if they will both
 622  * provide the same access to files based on mode/uid/gid.
 623  * If the credentials are different, then either -1 or 1 will
 624  * be returned depending on whether @a comes before or after @b
 625  * respectively in an arbitrary, but stable, ordering of credentials.
 626  *
 627  * Return: -1, 0, or 1 depending on comparison
 628  */
 629 int cred_fscmp(const struct cred *a, const struct cred *b)
 630 {
 631         struct group_info *ga, *gb;
 632         int g;
 633
 634         if (a == b)
 635                 return 0;
 636         if (uid_lt(a->fsuid, b->fsuid))
 637                 return -1;
 638         if (uid_gt(a->fsuid, b->fsuid))
 639                 return 1;
 640
 641         if (gid_lt(a->fsgid, b->fsgid))
 642                 return -1;
 643         if (gid_gt(a->fsgid, b->fsgid))
 644                 return 1;
 645
 646         ga = a->group_info;
 647         gb = b->group_info;
 648         if (ga == gb)
 649                 return 0;
 650         if (ga == NULL)
 651                 return -1;
 652         if (gb == NULL)
 653                 return 1;
 654         if (ga->ngroups < gb->ngroups)
 655                 return -1;
 656         if (ga->ngroups > gb->ngroups)
 657                 return 1;
 658
 659         for (g = 0; g < ga->ngroups; g++) {
 660                 if (gid_lt(ga->gid[g], gb->gid[g]))
 661                         return -1;
 662                 if (gid_gt(ga->gid[g], gb->gid[g]))
 663                         return 1;
 664         }
 665         return 0;
 666 }
 667 EXPORT_SYMBOL(cred_fscmp);
 668
 669 int set_cred_ucounts(struct cred *new)
 670 {
 671         struct ucounts *new_ucounts, *old_ucounts = new->ucounts;
 672
 673         /*
 674          * This optimization is needed because alloc_ucounts() uses locks
 675          * for table lookups.
 676          */
 677         if (old_ucounts->ns == new->user_ns && uid_eq(old_ucounts->uid, new->uid))
 678                 return 0;
 679
 680         if (!(new_ucounts = alloc_ucounts(new->user_ns, new->uid)))
 681                 return -EAGAIN;
 682
 683         new->ucounts = new_ucounts;
 684         put_ucounts(old_ucounts);
 685
 686         return 0;
 687 }
 688
 689 /*
 690  * initialise the credentials stuff
 691  */
 692 void __init cred_init(void)
 693 {
 694         /* allocate a slab in which we can store credentials */
 695         cred_jar = kmem_cache_create("cred_jar", sizeof(struct cred), 0,
 696                         SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, NULL);
 697 }
 698
 699 /**
 700  * prepare_kernel_cred - Prepare a set of credentials for a kernel service
 701  * @daemon: A userspace daemon to be used as a reference
 702  *
 703  * Prepare a set of credentials for a kernel service.  This can then be used to
 704  * override a task's own credentials so that work can be done on behalf of that
 705  * task that requires a different subjective context.
 706  *
 707  * @daemon is used to provide a base cred, with the security data derived from
 708  * that; if this is "&init_task", they'll be set to 0, no groups, full
 709  * capabilities, and no keys.
 710  *
 711  * The caller may change these controls afterwards if desired.
 712  *
 713  * Returns the new credentials or NULL if out of memory.
 714  */
 715 struct cred *prepare_kernel_cred(struct task_struct *daemon)
 716 {
 717         const struct cred *old;
 718         struct cred *new;
 719
 720         if (WARN_ON_ONCE(!daemon))
 721                 return NULL;
 722
 723         new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
 724         if (!new)
 725                 return NULL;
 726
 727         kdebug("prepare_kernel_cred() alloc %p", new);
 728
 729         old = get_task_cred(daemon);
 730         validate_creds(old);
 731
 732         *new = *old;
 733         new->non_rcu = 0;
 734         atomic_set(&new->usage, 1);
 735         set_cred_subscribers(new, 0);
 736         get_uid(new->user);
 737         get_user_ns(new->user_ns);
 738         get_group_info(new->group_info);
 739
 740 #ifdef CONFIG_KEYS
 741         new->session_keyring = NULL;
 742         new->process_keyring = NULL;
 743         new->thread_keyring = NULL;
 744         new->request_key_auth = NULL;
 745         new->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
 746 #endif
 747
 748 #ifdef CONFIG_SECURITY
 749         new->security = NULL;
 750 #endif
 751         new->ucounts = get_ucounts(new->ucounts);
 752         if (!new->ucounts)
 753                 goto error;
 754
 755         if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
 756                 goto error;
 757
 758         put_cred(old);
 759         validate_creds(new);
 760         return new;
 761
 762 error:
 763         put_cred(new);
 764         put_cred(old);
 765         return NULL;
 766 }
 767 EXPORT_SYMBOL(prepare_kernel_cred);
 768
 769 /**
 770  * set_security_override - Set the security ID in a set of credentials
 771  * @new: The credentials to alter
 772  * @secid: The LSM security ID to set
 773  *
 774  * Set the LSM security ID in a set of credentials so that the subjective
 775  * security is overridden when an alternative set of credentials is used.
 776  */
 777 int set_security_override(struct cred *new, u32 secid)
 778 {
 779         return security_kernel_act_as(new, secid);
 780 }
 781 EXPORT_SYMBOL(set_security_override);
 782
 783 /**
 784  * set_security_override_from_ctx - Set the security ID in a set of credentials
 785  * @new: The credentials to alter
 786  * @secctx: The LSM security context to generate the security ID from.
 787  *
 788  * Set the LSM security ID in a set of credentials so that the subjective
 789  * security is overridden when an alternative set of credentials is used.  The
 790  * security ID is specified in string form as a security context to be
 791  * interpreted by the LSM.
 792  */
 793 int set_security_override_from_ctx(struct cred *new, const char *secctx)
 794 {
 795         u32 secid;
 796         int ret;
 797
 798         ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
 799         if (ret < 0)
 800                 return ret;
 801
 802         return set_security_override(new, secid);
 803 }
 804 EXPORT_SYMBOL(set_security_override_from_ctx);
 805
 806 /**
 807  * set_create_files_as - Set the LSM file create context in a set of credentials
 808  * @new: The credentials to alter
 809  * @inode: The inode to take the context from
 810  *
 811  * Change the LSM file creation context in a set of credentials to be the same
 812  * as the object context of the specified inode, so that the new inodes have
 813  * the same MAC context as that inode.
 814  */
 815 int set_create_files_as(struct cred *new, struct inode *inode)
 816 {
 817         if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid))
 818                 return -EINVAL;
 819         new->fsuid = inode->i_uid;
 820         new->fsgid = inode->i_gid;
 821         return security_kernel_create_files_as(new, inode);
 822 }
 823 EXPORT_SYMBOL(set_create_files_as);
 824
 825 #ifdef CONFIG_DEBUG_CREDENTIALS
 826
 827 bool creds_are_invalid(const struct cred *cred)
 828 {
 829         if (cred->magic != CRED_MAGIC)
 830                 return true;
 831         return false;
 832 }
 833 EXPORT_SYMBOL(creds_are_invalid);
 834
 835 /*
 836  * dump invalid credentials
 837  */
 838 static void dump_invalid_creds(const struct cred *cred, const char *label,
 839                                const struct task_struct *tsk)
 840 {
 841         pr_err("%s credentials: %p %s%s%s\n",
 842                label, cred,
 843                cred == &init_cred ? "[init]" : "",
 844                cred == tsk->real_cred ? "[real]" : "",
 845                cred == tsk->cred ? "[eff]" : "");
 846         pr_err("->magic=%x, put_addr=%p\n",
 847                cred->magic, cred->put_addr);
 848         pr_err("->usage=%d, subscr=%d\n",
 849                atomic_read(&cred->usage),
 850                read_cred_subscribers(cred));
 851         pr_err("->*uid = { %d,%d,%d,%d }\n",
 852                 from_kuid_munged(&init_user_ns, cred->uid),
 853                 from_kuid_munged(&init_user_ns, cred->euid),
 854                 from_kuid_munged(&init_user_ns, cred->suid),
 855                 from_kuid_munged(&init_user_ns, cred->fsuid));
 856         pr_err("->*gid = { %d,%d,%d,%d }\n",
 857                 from_kgid_munged(&init_user_ns, cred->gid),
 858                 from_kgid_munged(&init_user_ns, cred->egid),
 859                 from_kgid_munged(&init_user_ns, cred->sgid),
 860                 from_kgid_munged(&init_user_ns, cred->fsgid));
 861 #ifdef CONFIG_SECURITY
 862         pr_err("->security is %p\n", cred->security);
 863         if ((unsigned long) cred->security >= PAGE_SIZE &&
 864             (((unsigned long) cred->security & 0xffffff00) !=
 865              (POISON_FREE << 24 | POISON_FREE << 16 | POISON_FREE << 8)))
 866                 pr_err("->security {%x, %x}\n",
 867                        ((u32*)cred->security)[0],
 868                        ((u32*)cred->security)[1]);
 869 #endif
 870 }
 871
 872 /*
 873  * report use of invalid credentials
 874  */
 875 void __noreturn __invalid_creds(const struct cred *cred, const char *file, unsigned line)
 876 {
 877         pr_err("Invalid credentials\n");
 878         pr_err("At %s:%u\n", file, line);
 879         dump_invalid_creds(cred, "Specified", current);
 880         BUG();
 881 }
 882 EXPORT_SYMBOL(__invalid_creds);
 883
 884 /*
 885  * check the credentials on a process
 886  */
 887 void __validate_process_creds(struct task_struct *tsk,
 888                               const char *file, unsigned line)
 889 {
 890         if (tsk->cred == tsk->real_cred) {
 891                 if (unlikely(read_cred_subscribers(tsk->cred) < 2 ||
 892                              creds_are_invalid(tsk->cred)))
 893                         goto invalid_creds;
 894         } else {
 895                 if (unlikely(read_cred_subscribers(tsk->real_cred) < 1 ||
 896                              read_cred_subscribers(tsk->cred) < 1 ||
 897                              creds_are_invalid(tsk->real_cred) ||
 898                              creds_are_invalid(tsk->cred)))
 899                         goto invalid_creds;
 900         }
 901         return;
 902
 903 invalid_creds:
 904         pr_err("Invalid process credentials\n");
 905         pr_err("At %s:%u\n", file, line);
 906
 907         dump_invalid_creds(tsk->real_cred, "Real", tsk);
 908         if (tsk->cred != tsk->real_cred)
 909                 dump_invalid_creds(tsk->cred, "Effective", tsk);
 910         else
 911                 pr_err("Effective creds == Real creds\n");
 912         BUG();
 913 }
 914 EXPORT_SYMBOL(__validate_process_creds);
 915
 916 /*
 917  * check creds for do_exit()
 918  */
 919 void validate_creds_for_do_exit(struct task_struct *tsk)
 920 {
 921         kdebug("validate_creds_for_do_exit(%p,%p{%d,%d})",
 922                tsk->real_cred, tsk->cred,
 923                atomic_read(&tsk->cred->usage),
 924                read_cred_subscribers(tsk->cred));
 925
 926         __validate_process_creds(tsk, __FILE__, __LINE__);
 927 }
 928
 929 #endif /* CONFIG_DEBUG_CREDENTIALS */