cred.h 11.9 KB
Newer Older
R
Randy Dunlap 已提交
1
/* Credentials management - see Documentation/security/credentials.txt
2 3 4 5 6 7 8 9 10 11 12 13 14
 *
 * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved.
 * Written by David Howells (dhowells@redhat.com)
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public Licence
 * as published by the Free Software Foundation; either version
 * 2 of the Licence, or (at your option) any later version.
 */

#ifndef _LINUX_CRED_H
#define _LINUX_CRED_H

15
#include <linux/capability.h>
16
#include <linux/init.h>
17
#include <linux/key.h>
18
#include <linux/selinux.h>
A
Arun Sharma 已提交
19
#include <linux/atomic.h>
20
#include <linux/uidgid.h>
21 22 23

struct user_struct;
struct cred;
24
struct inode;
25 26 27 28 29

/*
 * COW Supplementary groups list
 */
#define NGROUPS_SMALL		32
30
#define NGROUPS_PER_BLOCK	((unsigned int)(PAGE_SIZE / sizeof(kgid_t)))
31 32 33 34 35

struct group_info {
	atomic_t	usage;
	int		ngroups;
	int		nblocks;
36 37
	kgid_t		small_block[NGROUPS_SMALL];
	kgid_t		*blocks[0];
38 39 40 41 42 43
};

/**
 * get_group_info - Get a reference to a group info structure
 * @group_info: The group info to reference
 *
44 45 46 47
 * This gets a reference to a set of supplementary groups.
 *
 * If the caller is accessing a task's credentials, they must hold the RCU read
 * lock when reading.
48
 */
49 50 51 52 53
static inline struct group_info *get_group_info(struct group_info *gi)
{
	atomic_inc(&gi->usage);
	return gi;
}
54 55 56 57 58 59 60 61 62 63 64 65

/**
 * put_group_info - Release a reference to a group info structure
 * @group_info: The group info to release
 */
#define put_group_info(group_info)			\
do {							\
	if (atomic_dec_and_test(&(group_info)->usage))	\
		groups_free(group_info);		\
} while (0)

extern struct group_info *groups_alloc(int);
66
extern struct group_info init_groups;
67 68 69
extern void groups_free(struct group_info *);
extern int set_current_groups(struct group_info *);
extern int set_groups(struct cred *, struct group_info *);
70
extern int groups_search(const struct group_info *, kgid_t);
71 72 73 74 75 76 77 78

/* access the groups "array" with this macro */
#define GROUP_AT(gi, i) \
	((gi)->blocks[(i) / NGROUPS_PER_BLOCK][(i) % NGROUPS_PER_BLOCK])

extern int in_group_p(gid_t);
extern int in_egroup_p(gid_t);

79 80 81 82 83 84 85 86 87
/*
 * The common credentials for a thread group
 * - shared by CLONE_THREAD
 */
#ifdef CONFIG_KEYS
struct thread_group_cred {
	atomic_t	usage;
	pid_t		tgid;			/* thread group process ID */
	spinlock_t	lock;
A
Arnd Bergmann 已提交
88
	struct key __rcu *session_keyring;	/* keyring inherited over fork */
89 90 91 92 93
	struct key	*process_keyring;	/* keyring private to this process */
	struct rcu_head	rcu;			/* RCU deletion hook */
};
#endif

94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118
/*
 * The security context of a task
 *
 * The parts of the context break down into two categories:
 *
 *  (1) The objective context of a task.  These parts are used when some other
 *	task is attempting to affect this one.
 *
 *  (2) The subjective context.  These details are used when the task is acting
 *	upon another object, be that a file, a task, a key or whatever.
 *
 * Note that some members of this structure belong to both categories - the
 * LSM security pointer for instance.
 *
 * A task has two security pointers.  task->real_cred points to the objective
 * context that defines that task's actual details.  The objective part of this
 * context is used whenever that task is acted upon.
 *
 * task->cred points to the subjective context that defines the details of how
 * that task is going to act upon another object.  This may be overridden
 * temporarily to point to another security context, but normally points to the
 * same context as task->real_cred.
 */
struct cred {
	atomic_t	usage;
119 120 121 122 123 124 125
#ifdef CONFIG_DEBUG_CREDENTIALS
	atomic_t	subscribers;	/* number of processes subscribed */
	void		*put_addr;
	unsigned	magic;
#define CRED_MAGIC	0x43736564
#define CRED_MAGIC_DEAD	0x44656144
#endif
126 127 128 129 130 131 132 133
	kuid_t		uid;		/* real UID of the task */
	kgid_t		gid;		/* real GID of the task */
	kuid_t		suid;		/* saved UID of the task */
	kgid_t		sgid;		/* saved GID of the task */
	kuid_t		euid;		/* effective UID of the task */
	kgid_t		egid;		/* effective GID of the task */
	kuid_t		fsuid;		/* UID for VFS ops */
	kgid_t		fsgid;		/* GID for VFS ops */
134 135 136 137 138 139 140 141 142 143
	unsigned	securebits;	/* SUID-less security management */
	kernel_cap_t	cap_inheritable; /* caps our children can inherit */
	kernel_cap_t	cap_permitted;	/* caps we're permitted */
	kernel_cap_t	cap_effective;	/* caps we can actually use */
	kernel_cap_t	cap_bset;	/* capability bounding set */
#ifdef CONFIG_KEYS
	unsigned char	jit_keyring;	/* default keyring to attach requested
					 * keys to */
	struct key	*thread_keyring; /* keyring private to this thread */
	struct key	*request_key_auth; /* assumed request_key authority */
144
	struct thread_group_cred *tgcred; /* thread-group shared credentials */
145 146 147 148 149
#endif
#ifdef CONFIG_SECURITY
	void		*security;	/* subjective LSM security */
#endif
	struct user_struct *user;	/* real user ID subscription */
150
	struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
151 152 153 154
	struct group_info *group_info;	/* supplementary groups for euid/fsgid */
	struct rcu_head	rcu;		/* RCU deletion hook */
};

155
extern void __put_cred(struct cred *);
156
extern void exit_creds(struct task_struct *);
157
extern int copy_creds(struct task_struct *, unsigned long);
158
extern const struct cred *get_task_cred(struct task_struct *);
159
extern struct cred *cred_alloc_blank(void);
D
David Howells 已提交
160
extern struct cred *prepare_creds(void);
161
extern struct cred *prepare_exec_creds(void);
D
David Howells 已提交
162 163
extern int commit_creds(struct cred *);
extern void abort_creds(struct cred *);
164 165
extern const struct cred *override_creds(const struct cred *);
extern void revert_creds(const struct cred *);
166 167 168 169 170
extern struct cred *prepare_kernel_cred(struct task_struct *);
extern int change_create_files_as(struct cred *, struct inode *);
extern int set_security_override(struct cred *, u32);
extern int set_security_override_from_ctx(struct cred *, const char *);
extern int set_create_files_as(struct cred *, struct inode *);
D
David Howells 已提交
171 172
extern void __init cred_init(void);

173 174 175 176 177 178 179 180
/*
 * check for validity of credentials
 */
#ifdef CONFIG_DEBUG_CREDENTIALS
extern void __invalid_creds(const struct cred *, const char *, unsigned);
extern void __validate_process_creds(struct task_struct *,
				     const char *, unsigned);

A
Andrew Morton 已提交
181
extern bool creds_are_invalid(const struct cred *cred);
182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212

static inline void __validate_creds(const struct cred *cred,
				    const char *file, unsigned line)
{
	if (unlikely(creds_are_invalid(cred)))
		__invalid_creds(cred, file, line);
}

#define validate_creds(cred)				\
do {							\
	__validate_creds((cred), __FILE__, __LINE__);	\
} while(0)

#define validate_process_creds()				\
do {								\
	__validate_process_creds(current, __FILE__, __LINE__);	\
} while(0)

extern void validate_creds_for_do_exit(struct task_struct *);
#else
static inline void validate_creds(const struct cred *cred)
{
}
static inline void validate_creds_for_do_exit(struct task_struct *tsk)
{
}
static inline void validate_process_creds(void)
{
}
#endif

D
David Howells 已提交
213 214 215 216 217 218 219 220 221 222 223 224
/**
 * get_new_cred - Get a reference on a new set of credentials
 * @cred: The new credentials to reference
 *
 * Get a reference on the specified set of new credentials.  The caller must
 * release the reference.
 */
static inline struct cred *get_new_cred(struct cred *cred)
{
	atomic_inc(&cred->usage);
	return cred;
}
225 226 227 228 229 230 231

/**
 * get_cred - Get a reference on a set of credentials
 * @cred: The credentials to reference
 *
 * Get a reference on the specified set of credentials.  The caller must
 * release the reference.
D
David Howells 已提交
232 233 234 235 236 237
 *
 * This is used to deal with a committed set of credentials.  Although the
 * pointer is const, this will temporarily discard the const and increment the
 * usage count.  The purpose of this is to attempt to catch at compile time the
 * accidental alteration of a set of credentials that should be considered
 * immutable.
238
 */
D
David Howells 已提交
239
static inline const struct cred *get_cred(const struct cred *cred)
240
{
241
	struct cred *nonconst_cred = (struct cred *) cred;
242
	validate_creds(cred);
243
	return get_new_cred(nonconst_cred);
244 245 246 247 248 249 250 251
}

/**
 * put_cred - Release a reference to a set of credentials
 * @cred: The credentials to release
 *
 * Release a reference to a set of credentials, deleting them when the last ref
 * is released.
D
David Howells 已提交
252 253 254 255
 *
 * This takes a const pointer to a set of credentials because the credentials
 * on task_struct are attached by const pointers to prevent accidental
 * alteration of otherwise immutable credential sets.
256
 */
257
static inline void put_cred(const struct cred *_cred)
258
{
259
	struct cred *cred = (struct cred *) _cred;
D
David Howells 已提交
260

261
	validate_creds(cred);
262 263 264 265
	if (atomic_dec_and_test(&(cred)->usage))
		__put_cred(cred);
}

266
/**
267
 * current_cred - Access the current task's subjective credentials
268
 *
A
Al Viro 已提交
269 270
 * Access the subjective credentials of the current task.  RCU-safe,
 * since nobody else can modify it.
271 272
 */
#define current_cred() \
273
	rcu_dereference_protected(current->cred, 1)
274 275

/**
276
 * __task_cred - Access a task's objective credentials
277 278
 * @task: The task to query
 *
279
 * Access the objective credentials of a task.  The caller must hold the RCU
280
 * readlock or the task must be dead and unable to change its own credentials.
281
 *
282 283
 * The result of this function should not be passed directly to get_cred();
 * rather get_task_cred() should be used instead.
284
 */
285 286 287 288 289 290
#define __task_cred(task)						\
	({								\
		const struct task_struct *__t = (task);			\
		rcu_dereference_check(__t->real_cred,			\
				      task_is_dead(__t));		\
	})
291 292

/**
293
 * get_current_cred - Get the current task's subjective credentials
294
 *
295 296 297
 * Get the subjective credentials of the current task, pinning them so that
 * they can't go away.  Accessing the current task's credentials directly is
 * not permitted.
298 299 300 301 302 303 304 305 306 307 308 309 310
 */
#define get_current_cred()				\
	(get_cred(current_cred()))

/**
 * get_current_user - Get the current task's user_struct
 *
 * Get the user record of the current task, pinning it so that it can't go
 * away.
 */
#define get_current_user()				\
({							\
	struct user_struct *__u;			\
311
	const struct cred *__cred;			\
A
Al Viro 已提交
312
	__cred = current_cred();			\
313 314 315 316 317 318 319 320 321 322 323 324 325
	__u = get_uid(__cred->user);			\
	__u;						\
})

/**
 * get_current_groups - Get the current task's supplementary group list
 *
 * Get the supplementary group list of the current task, pinning it so that it
 * can't go away.
 */
#define get_current_groups()				\
({							\
	struct group_info *__groups;			\
326
	const struct cred *__cred;			\
A
Al Viro 已提交
327
	__cred = current_cred();			\
328 329 330 331
	__groups = get_group_info(__cred->group_info);	\
	__groups;					\
})

D
David Howells 已提交
332 333 334 335 336 337 338
#define task_cred_xxx(task, xxx)			\
({							\
	__typeof__(((struct cred *)NULL)->xxx) ___val;	\
	rcu_read_lock();				\
	___val = __task_cred((task))->xxx;		\
	rcu_read_unlock();				\
	___val;						\
339 340 341 342 343 344 345
})

#define task_uid(task)		(task_cred_xxx((task), uid))
#define task_euid(task)		(task_cred_xxx((task), euid))

#define current_cred_xxx(xxx)			\
({						\
A
Al Viro 已提交
346
	current_cred()->xxx;			\
347 348 349 350 351 352 353 354 355 356 357 358 359 360
})

#define current_uid()		(current_cred_xxx(uid))
#define current_gid()		(current_cred_xxx(gid))
#define current_euid()		(current_cred_xxx(euid))
#define current_egid()		(current_cred_xxx(egid))
#define current_suid()		(current_cred_xxx(suid))
#define current_sgid()		(current_cred_xxx(sgid))
#define current_fsuid() 	(current_cred_xxx(fsuid))
#define current_fsgid() 	(current_cred_xxx(fsgid))
#define current_cap()		(current_cred_xxx(cap_effective))
#define current_user()		(current_cred_xxx(user))
#define current_security()	(current_cred_xxx(security))

361
extern struct user_namespace init_user_ns;
S
Serge E. Hallyn 已提交
362
#ifdef CONFIG_USER_NS
363 364
#define current_user_ns()	(current_cred_xxx(user_ns))
#define task_user_ns(task)	(task_cred_xxx((task), user_ns))
S
Serge E. Hallyn 已提交
365
#else
366 367
#define current_user_ns()	(&init_user_ns)
#define task_user_ns(task)	(&init_user_ns)
S
Serge E. Hallyn 已提交
368 369
#endif

370

371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394
#define current_uid_gid(_uid, _gid)		\
do {						\
	const struct cred *__cred;		\
	__cred = current_cred();		\
	*(_uid) = __cred->uid;			\
	*(_gid) = __cred->gid;			\
} while(0)

#define current_euid_egid(_euid, _egid)		\
do {						\
	const struct cred *__cred;		\
	__cred = current_cred();		\
	*(_euid) = __cred->euid;		\
	*(_egid) = __cred->egid;		\
} while(0)

#define current_fsuid_fsgid(_fsuid, _fsgid)	\
do {						\
	const struct cred *__cred;		\
	__cred = current_cred();		\
	*(_fsuid) = __cred->fsuid;		\
	*(_fsgid) = __cred->fsgid;		\
} while(0)

395
#endif /* _LINUX_CRED_H */