1/* Credentials management - see Documentation/security/credentials.txt
2 *
3 * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public Licence
8 * as published by the Free Software Foundation; either version
9 * 2 of the Licence, or (at your option) any later version.
10 */
11
12#ifndef _LINUX_CRED_H
13#define _LINUX_CRED_H
14
15#include <linux/capability.h>
16#include <linux/init.h>
17#include <linux/key.h>
18#include <linux/selinux.h>
19#include <linux/atomic.h>
20#include <linux/uidgid.h>
21
22struct user_struct;
23struct cred;
24struct inode;
25
26/*
27 * COW Supplementary groups list
28 */
29#define NGROUPS_SMALL		32
30#define NGROUPS_PER_BLOCK	((unsigned int)(PAGE_SIZE / sizeof(kgid_t)))
31
32struct group_info {
33	atomic_t	usage;
34	int		ngroups;
35	int		nblocks;
36	kgid_t		small_block[NGROUPS_SMALL];
37	kgid_t		*blocks[0];
38};
39
40/**
41 * get_group_info - Get a reference to a group info structure
42 * @group_info: The group info to reference
43 *
44 * This gets a reference to a set of supplementary groups.
45 *
46 * If the caller is accessing a task's credentials, they must hold the RCU read
47 * lock when reading.
48 */
49static inline struct group_info *get_group_info(struct group_info *gi)
50{
51	atomic_inc(&gi->usage);
52	return gi;
53}
54
55/**
56 * put_group_info - Release a reference to a group info structure
57 * @group_info: The group info to release
58 */
59#define put_group_info(group_info)			\
60do {							\
61	if (atomic_dec_and_test(&(group_info)->usage))	\
62		groups_free(group_info);		\
63} while (0)
64
65extern struct group_info init_groups;
66#ifdef CONFIG_MULTIUSER
67extern struct group_info *groups_alloc(int);
68extern void groups_free(struct group_info *);
69
70extern int in_group_p(kgid_t);
71extern int in_egroup_p(kgid_t);
72#else
73static inline void groups_free(struct group_info *group_info)
74{
75}
76
77static inline int in_group_p(kgid_t grp)
78{
79        return 1;
80}
81static inline int in_egroup_p(kgid_t grp)
82{
83        return 1;
84}
85#endif
86extern int set_current_groups(struct group_info *);
87extern void set_groups(struct cred *, struct group_info *);
88extern int groups_search(const struct group_info *, kgid_t);
89extern bool may_setgroups(void);
90
91/* access the groups "array" with this macro */
92#define GROUP_AT(gi, i) \
93	((gi)->blocks[(i) / NGROUPS_PER_BLOCK][(i) % NGROUPS_PER_BLOCK])
94
95/*
96 * The security context of a task
97 *
98 * The parts of the context break down into two categories:
99 *
100 *  (1) The objective context of a task.  These parts are used when some other
101 *	task is attempting to affect this one.
102 *
103 *  (2) The subjective context.  These details are used when the task is acting
104 *	upon another object, be that a file, a task, a key or whatever.
105 *
106 * Note that some members of this structure belong to both categories - the
107 * LSM security pointer for instance.
108 *
109 * A task has two security pointers.  task->real_cred points to the objective
110 * context that defines that task's actual details.  The objective part of this
111 * context is used whenever that task is acted upon.
112 *
113 * task->cred points to the subjective context that defines the details of how
114 * that task is going to act upon another object.  This may be overridden
115 * temporarily to point to another security context, but normally points to the
116 * same context as task->real_cred.
117 */
118struct cred {
119	atomic_t	usage;
120#ifdef CONFIG_DEBUG_CREDENTIALS
121	atomic_t	subscribers;	/* number of processes subscribed */
122	void		*put_addr;
123	unsigned	magic;
124#define CRED_MAGIC	0x43736564
125#define CRED_MAGIC_DEAD	0x44656144
126#endif
127	kuid_t		uid;		/* real UID of the task */
128	kgid_t		gid;		/* real GID of the task */
129	kuid_t		suid;		/* saved UID of the task */
130	kgid_t		sgid;		/* saved GID of the task */
131	kuid_t		euid;		/* effective UID of the task */
132	kgid_t		egid;		/* effective GID of the task */
133	kuid_t		fsuid;		/* UID for VFS ops */
134	kgid_t		fsgid;		/* GID for VFS ops */
135	unsigned	securebits;	/* SUID-less security management */
136	kernel_cap_t	cap_inheritable; /* caps our children can inherit */
137	kernel_cap_t	cap_permitted;	/* caps we're permitted */
138	kernel_cap_t	cap_effective;	/* caps we can actually use */
139	kernel_cap_t	cap_bset;	/* capability bounding set */
140#ifdef CONFIG_KEYS
141	unsigned char	jit_keyring;	/* default keyring to attach requested
142					 * keys to */
143	struct key __rcu *session_keyring; /* keyring inherited over fork */
144	struct key	*process_keyring; /* keyring private to this process */
145	struct key	*thread_keyring; /* keyring private to this thread */
146	struct key	*request_key_auth; /* assumed request_key authority */
147#endif
148#ifdef CONFIG_SECURITY
149	void		*security;	/* subjective LSM security */
150#endif
151	struct user_struct *user;	/* real user ID subscription */
152	struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
153	struct group_info *group_info;	/* supplementary groups for euid/fsgid */
154	struct rcu_head	rcu;		/* RCU deletion hook */
155};
156
157extern void __put_cred(struct cred *);
158extern void exit_creds(struct task_struct *);
159extern int copy_creds(struct task_struct *, unsigned long);
160extern const struct cred *get_task_cred(struct task_struct *);
161extern struct cred *cred_alloc_blank(void);
162extern struct cred *prepare_creds(void);
163extern struct cred *prepare_exec_creds(void);
164extern int commit_creds(struct cred *);
165extern void abort_creds(struct cred *);
166extern const struct cred *override_creds(const struct cred *);
167extern void revert_creds(const struct cred *);
168extern struct cred *prepare_kernel_cred(struct task_struct *);
169extern int change_create_files_as(struct cred *, struct inode *);
170extern int set_security_override(struct cred *, u32);
171extern int set_security_override_from_ctx(struct cred *, const char *);
172extern int set_create_files_as(struct cred *, struct inode *);
173extern void __init cred_init(void);
174
175/*
176 * check for validity of credentials
177 */
178#ifdef CONFIG_DEBUG_CREDENTIALS
179extern void __invalid_creds(const struct cred *, const char *, unsigned);
180extern void __validate_process_creds(struct task_struct *,
181				     const char *, unsigned);
182
183extern bool creds_are_invalid(const struct cred *cred);
184
185static inline void __validate_creds(const struct cred *cred,
186				    const char *file, unsigned line)
187{
188	if (unlikely(creds_are_invalid(cred)))
189		__invalid_creds(cred, file, line);
190}
191
192#define validate_creds(cred)				\
193do {							\
194	__validate_creds((cred), __FILE__, __LINE__);	\
195} while(0)
196
197#define validate_process_creds()				\
198do {								\
199	__validate_process_creds(current, __FILE__, __LINE__);	\
200} while(0)
201
202extern void validate_creds_for_do_exit(struct task_struct *);
203#else
204static inline void validate_creds(const struct cred *cred)
205{
206}
207static inline void validate_creds_for_do_exit(struct task_struct *tsk)
208{
209}
210static inline void validate_process_creds(void)
211{
212}
213#endif
214
215/**
216 * get_new_cred - Get a reference on a new set of credentials
217 * @cred: The new credentials to reference
218 *
219 * Get a reference on the specified set of new credentials.  The caller must
220 * release the reference.
221 */
222static inline struct cred *get_new_cred(struct cred *cred)
223{
224	atomic_inc(&cred->usage);
225	return cred;
226}
227
228/**
229 * get_cred - Get a reference on a set of credentials
230 * @cred: The credentials to reference
231 *
232 * Get a reference on the specified set of credentials.  The caller must
233 * release the reference.
234 *
235 * This is used to deal with a committed set of credentials.  Although the
236 * pointer is const, this will temporarily discard the const and increment the
237 * usage count.  The purpose of this is to attempt to catch at compile time the
238 * accidental alteration of a set of credentials that should be considered
239 * immutable.
240 */
241static inline const struct cred *get_cred(const struct cred *cred)
242{
243	struct cred *nonconst_cred = (struct cred *) cred;
244	validate_creds(cred);
245	return get_new_cred(nonconst_cred);
246}
247
248/**
249 * put_cred - Release a reference to a set of credentials
250 * @cred: The credentials to release
251 *
252 * Release a reference to a set of credentials, deleting them when the last ref
253 * is released.
254 *
255 * This takes a const pointer to a set of credentials because the credentials
256 * on task_struct are attached by const pointers to prevent accidental
257 * alteration of otherwise immutable credential sets.
258 */
259static inline void put_cred(const struct cred *_cred)
260{
261	struct cred *cred = (struct cred *) _cred;
262
263	validate_creds(cred);
264	if (atomic_dec_and_test(&(cred)->usage))
265		__put_cred(cred);
266}
267
268/**
269 * current_cred - Access the current task's subjective credentials
270 *
271 * Access the subjective credentials of the current task.  RCU-safe,
272 * since nobody else can modify it.
273 */
274#define current_cred() \
275	rcu_dereference_protected(current->cred, 1)
276
277/**
278 * current_real_cred - Access the current task's objective credentials
279 *
280 * Access the objective credentials of the current task.  RCU-safe,
281 * since nobody else can modify it.
282 */
283#define current_real_cred() \
284	rcu_dereference_protected(current->real_cred, 1)
285
286/**
287 * __task_cred - Access a task's objective credentials
288 * @task: The task to query
289 *
290 * Access the objective credentials of a task.  The caller must hold the RCU
291 * readlock.
292 *
293 * The result of this function should not be passed directly to get_cred();
294 * rather get_task_cred() should be used instead.
295 */
296#define __task_cred(task)	\
297	rcu_dereference((task)->real_cred)
298
299/**
300 * get_current_cred - Get the current task's subjective credentials
301 *
302 * Get the subjective credentials of the current task, pinning them so that
303 * they can't go away.  Accessing the current task's credentials directly is
304 * not permitted.
305 */
306#define get_current_cred()				\
307	(get_cred(current_cred()))
308
309/**
310 * get_current_user - Get the current task's user_struct
311 *
312 * Get the user record of the current task, pinning it so that it can't go
313 * away.
314 */
315#define get_current_user()				\
316({							\
317	struct user_struct *__u;			\
318	const struct cred *__cred;			\
319	__cred = current_cred();			\
320	__u = get_uid(__cred->user);			\
321	__u;						\
322})
323
324/**
325 * get_current_groups - Get the current task's supplementary group list
326 *
327 * Get the supplementary group list of the current task, pinning it so that it
328 * can't go away.
329 */
330#define get_current_groups()				\
331({							\
332	struct group_info *__groups;			\
333	const struct cred *__cred;			\
334	__cred = current_cred();			\
335	__groups = get_group_info(__cred->group_info);	\
336	__groups;					\
337})
338
339#define task_cred_xxx(task, xxx)			\
340({							\
341	__typeof__(((struct cred *)NULL)->xxx) ___val;	\
342	rcu_read_lock();				\
343	___val = __task_cred((task))->xxx;		\
344	rcu_read_unlock();				\
345	___val;						\
346})
347
348#define task_uid(task)		(task_cred_xxx((task), uid))
349#define task_euid(task)		(task_cred_xxx((task), euid))
350
351#define current_cred_xxx(xxx)			\
352({						\
353	current_cred()->xxx;			\
354})
355
356#define current_uid()		(current_cred_xxx(uid))
357#define current_gid()		(current_cred_xxx(gid))
358#define current_euid()		(current_cred_xxx(euid))
359#define current_egid()		(current_cred_xxx(egid))
360#define current_suid()		(current_cred_xxx(suid))
361#define current_sgid()		(current_cred_xxx(sgid))
362#define current_fsuid() 	(current_cred_xxx(fsuid))
363#define current_fsgid() 	(current_cred_xxx(fsgid))
364#define current_cap()		(current_cred_xxx(cap_effective))
365#define current_user()		(current_cred_xxx(user))
366#define current_security()	(current_cred_xxx(security))
367
368extern struct user_namespace init_user_ns;
369#ifdef CONFIG_USER_NS
370#define current_user_ns()	(current_cred_xxx(user_ns))
371#else
372#define current_user_ns()	(&init_user_ns)
373#endif
374
375
376#define current_uid_gid(_uid, _gid)		\
377do {						\
378	const struct cred *__cred;		\
379	__cred = current_cred();		\
380	*(_uid) = __cred->uid;			\
381	*(_gid) = __cred->gid;			\
382} while(0)
383
384#define current_euid_egid(_euid, _egid)		\
385do {						\
386	const struct cred *__cred;		\
387	__cred = current_cred();		\
388	*(_euid) = __cred->euid;		\
389	*(_egid) = __cred->egid;		\
390} while(0)
391
392#define current_fsuid_fsgid(_fsuid, _fsgid)	\
393do {						\
394	const struct cred *__cred;		\
395	__cred = current_cred();		\
396	*(_fsuid) = __cred->fsuid;		\
397	*(_fsgid) = __cred->fsgid;		\
398} while(0)
399
400#endif /* _LINUX_CRED_H */
401