1 /* SPDX-License-Identifier: GPL-2.0-or-later */ 2 /* Credentials management - see Documentation/security/credentials.rst 3 * 4 * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved. 5 * Written by David Howells ([email protected]) 6 */ 7 8 #ifndef _LINUX_CRED_H 9 #define _LINUX_CRED_H 10 11 #include <linux/capability.h> 12 #include <linux/init.h> 13 #include <linux/key.h> 14 #include <linux/atomic.h> 15 #include <linux/refcount.h> 16 #include <linux/uidgid.h> 17 #include <linux/sched.h> 18 #include <linux/sched/user.h> 19 20 struct cred; 21 struct inode; 22 23 /* 24 * COW Supplementary groups list 25 */ 26 struct group_info { 27 refcount_t usage; 28 int ngroups; 29 kgid_t gid[]; 30 } __randomize_layout; 31 32 /** 33 * get_group_info - Get a reference to a group info structure 34 * @group_info: The group info to reference 35 * 36 * This gets a reference to a set of supplementary groups. 37 * 38 * If the caller is accessing a task's credentials, they must hold the RCU read 39 * lock when reading. 40 */ 41 static inline struct group_info *get_group_info(struct group_info *gi) 42 { 43 refcount_inc(&gi->usage); 44 return gi; 45 } 46 47 /** 48 * put_group_info - Release a reference to a group info structure 49 * @group_info: The group info to release 50 */ 51 #define put_group_info(group_info) \ 52 do { \ 53 if (refcount_dec_and_test(&(group_info)->usage)) \ 54 groups_free(group_info); \ 55 } while (0) 56 57 #ifdef CONFIG_MULTIUSER 58 extern struct group_info *groups_alloc(int); 59 extern void groups_free(struct group_info *); 60 61 extern int in_group_p(kgid_t); 62 extern int in_egroup_p(kgid_t); 63 extern int groups_search(const struct group_info *, kgid_t); 64 65 extern int set_current_groups(struct group_info *); 66 extern void set_groups(struct cred *, struct group_info *); 67 extern bool may_setgroups(void); 68 extern void groups_sort(struct group_info *); 69 #else 70 static inline void groups_free(struct group_info *group_info) 71 { 72 } 73 74 static inline int in_group_p(kgid_t grp) 75 { 76 return 1; 77 } 78 static inline int in_egroup_p(kgid_t grp) 79 { 80 return 1; 81 } 82 static inline int groups_search(const struct group_info *group_info, kgid_t grp) 83 { 84 return 1; 85 } 86 #endif 87 88 /* 89 * The security context of a task 90 * 91 * The parts of the context break down into two categories: 92 * 93 * (1) The objective context of a task. These parts are used when some other 94 * task is attempting to affect this one. 95 * 96 * (2) The subjective context. These details are used when the task is acting 97 * upon another object, be that a file, a task, a key or whatever. 98 * 99 * Note that some members of this structure belong to both categories - the 100 * LSM security pointer for instance. 101 * 102 * A task has two security pointers. task->real_cred points to the objective 103 * context that defines that task's actual details. The objective part of this 104 * context is used whenever that task is acted upon. 105 * 106 * task->cred points to the subjective context that defines the details of how 107 * that task is going to act upon another object. This may be overridden 108 * temporarily to point to another security context, but normally points to the 109 * same context as task->real_cred. 110 */ 111 struct cred { 112 atomic_long_t usage; 113 kuid_t uid; /* real UID of the task */ 114 kgid_t gid; /* real GID of the task */ 115 kuid_t suid; /* saved UID of the task */ 116 kgid_t sgid; /* saved GID of the task */ 117 kuid_t euid; /* effective UID of the task */ 118 kgid_t egid; /* effective GID of the task */ 119 kuid_t fsuid; /* UID for VFS ops */ 120 kgid_t fsgid; /* GID for VFS ops */ 121 unsigned securebits; /* SUID-less security management */ 122 kernel_cap_t cap_inheritable; /* caps our children can inherit */ 123 kernel_cap_t cap_permitted; /* caps we're permitted */ 124 kernel_cap_t cap_effective; /* caps we can actually use */ 125 kernel_cap_t cap_bset; /* capability bounding set */ 126 kernel_cap_t cap_ambient; /* Ambient capability set */ 127 #ifdef CONFIG_KEYS 128 unsigned char jit_keyring; /* default keyring to attach requested 129 * keys to */ 130 struct key *session_keyring; /* keyring inherited over fork */ 131 struct key *process_keyring; /* keyring private to this process */ 132 struct key *thread_keyring; /* keyring private to this thread */ 133 struct key *request_key_auth; /* assumed request_key authority */ 134 #endif 135 #ifdef CONFIG_SECURITY 136 void *security; /* LSM security */ 137 #endif 138 struct user_struct *user; /* real user ID subscription */ 139 struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */ 140 struct ucounts *ucounts; 141 struct group_info *group_info; /* supplementary groups for euid/fsgid */ 142 /* RCU deletion */ 143 union { 144 int non_rcu; /* Can we skip RCU deletion? */ 145 struct rcu_head rcu; /* RCU deletion hook */ 146 }; 147 } __randomize_layout; 148 149 extern void __put_cred(struct cred *); 150 extern void exit_creds(struct task_struct *); 151 extern int copy_creds(struct task_struct *, unsigned long); 152 extern const struct cred *get_task_cred(struct task_struct *); 153 extern struct cred *cred_alloc_blank(void); 154 extern struct cred *prepare_creds(void); 155 extern struct cred *prepare_exec_creds(void); 156 extern int commit_creds(struct cred *); 157 extern void abort_creds(struct cred *); 158 extern struct cred *prepare_kernel_cred(struct task_struct *); 159 extern int set_security_override(struct cred *, u32); 160 extern int set_security_override_from_ctx(struct cred *, const char *); 161 extern int set_create_files_as(struct cred *, struct inode *); 162 extern int cred_fscmp(const struct cred *, const struct cred *); 163 extern void __init cred_init(void); 164 extern int set_cred_ucounts(struct cred *); 165 166 static inline bool cap_ambient_invariant_ok(const struct cred *cred) 167 { 168 return cap_issubset(cred->cap_ambient, 169 cap_intersect(cred->cap_permitted, 170 cred->cap_inheritable)); 171 } 172 173 static inline const struct cred *override_creds(const struct cred *override_cred) 174 { 175 const struct cred *old = current->cred; 176 177 rcu_assign_pointer(current->cred, override_cred); 178 return old; 179 } 180 181 static inline const struct cred *revert_creds(const struct cred *revert_cred) 182 { 183 const struct cred *override_cred = current->cred; 184 185 rcu_assign_pointer(current->cred, revert_cred); 186 return override_cred; 187 } 188 189 /** 190 * get_cred_many - Get references on a set of credentials 191 * @cred: The credentials to reference 192 * @nr: Number of references to acquire 193 * 194 * Get references on the specified set of credentials. The caller must release 195 * all acquired reference. If %NULL is passed, it is returned with no action. 196 * 197 * This is used to deal with a committed set of credentials. Although the 198 * pointer is const, this will temporarily discard the const and increment the 199 * usage count. The purpose of this is to attempt to catch at compile time the 200 * accidental alteration of a set of credentials that should be considered 201 * immutable. 202 */ 203 static inline const struct cred *get_cred_many(const struct cred *cred, int nr) 204 { 205 struct cred *nonconst_cred = (struct cred *) cred; 206 if (!cred) 207 return cred; 208 nonconst_cred->non_rcu = 0; 209 atomic_long_add(nr, &nonconst_cred->usage); 210 return cred; 211 } 212 213 /* 214 * get_cred - Get a reference on a set of credentials 215 * @cred: The credentials to reference 216 * 217 * Get a reference on the specified set of credentials. The caller must 218 * release the reference. If %NULL is passed, it is returned with no action. 219 * 220 * This is used to deal with a committed set of credentials. 221 */ 222 static inline const struct cred *get_cred(const struct cred *cred) 223 { 224 return get_cred_many(cred, 1); 225 } 226 227 static inline const struct cred *get_cred_rcu(const struct cred *cred) 228 { 229 struct cred *nonconst_cred = (struct cred *) cred; 230 if (!cred) 231 return NULL; 232 if (!atomic_long_inc_not_zero(&nonconst_cred->usage)) 233 return NULL; 234 nonconst_cred->non_rcu = 0; 235 return cred; 236 } 237 238 /** 239 * put_cred - Release a reference to a set of credentials 240 * @cred: The credentials to release 241 * @nr: Number of references to release 242 * 243 * Release a reference to a set of credentials, deleting them when the last ref 244 * is released. If %NULL is passed, nothing is done. 245 * 246 * This takes a const pointer to a set of credentials because the credentials 247 * on task_struct are attached by const pointers to prevent accidental 248 * alteration of otherwise immutable credential sets. 249 */ 250 static inline void put_cred_many(const struct cred *_cred, int nr) 251 { 252 struct cred *cred = (struct cred *) _cred; 253 254 if (cred) { 255 if (atomic_long_sub_and_test(nr, &cred->usage)) 256 __put_cred(cred); 257 } 258 } 259 260 /* 261 * put_cred - Release a reference to a set of credentials 262 * @cred: The credentials to release 263 * 264 * Release a reference to a set of credentials, deleting them when the last ref 265 * is released. If %NULL is passed, nothing is done. 266 */ 267 static inline void put_cred(const struct cred *cred) 268 { 269 put_cred_many(cred, 1); 270 } 271 272 /** 273 * current_cred - Access the current task's subjective credentials 274 * 275 * Access the subjective credentials of the current task. RCU-safe, 276 * since nobody else can modify it. 277 */ 278 #define current_cred() \ 279 rcu_dereference_protected(current->cred, 1) 280 281 /** 282 * current_real_cred - Access the current task's objective credentials 283 * 284 * Access the objective credentials of the current task. RCU-safe, 285 * since nobody else can modify it. 286 */ 287 #define current_real_cred() \ 288 rcu_dereference_protected(current->real_cred, 1) 289 290 /** 291 * __task_cred - Access a task's objective credentials 292 * @task: The task to query 293 * 294 * Access the objective credentials of a task. The caller must hold the RCU 295 * readlock. 296 * 297 * The result of this function should not be passed directly to get_cred(); 298 * rather get_task_cred() should be used instead. 299 */ 300 #define __task_cred(task) \ 301 rcu_dereference((task)->real_cred) 302 303 /** 304 * get_current_cred - Get the current task's subjective credentials 305 * 306 * Get the subjective credentials of the current task, pinning them so that 307 * they can't go away. Accessing the current task's credentials directly is 308 * not permitted. 309 */ 310 #define get_current_cred() \ 311 (get_cred(current_cred())) 312 313 /** 314 * get_current_user - Get the current task's user_struct 315 * 316 * Get the user record of the current task, pinning it so that it can't go 317 * away. 318 */ 319 #define get_current_user() \ 320 ({ \ 321 struct user_struct *__u; \ 322 const struct cred *__cred; \ 323 __cred = current_cred(); \ 324 __u = get_uid(__cred->user); \ 325 __u; \ 326 }) 327 328 /** 329 * get_current_groups - Get the current task's supplementary group list 330 * 331 * Get the supplementary group list of the current task, pinning it so that it 332 * can't go away. 333 */ 334 #define get_current_groups() \ 335 ({ \ 336 struct group_info *__groups; \ 337 const struct cred *__cred; \ 338 __cred = current_cred(); \ 339 __groups = get_group_info(__cred->group_info); \ 340 __groups; \ 341 }) 342 343 #define task_cred_xxx(task, xxx) \ 344 ({ \ 345 __typeof__(((struct cred *)NULL)->xxx) ___val; \ 346 rcu_read_lock(); \ 347 ___val = __task_cred((task))->xxx; \ 348 rcu_read_unlock(); \ 349 ___val; \ 350 }) 351 352 #define task_uid(task) (task_cred_xxx((task), uid)) 353 #define task_euid(task) (task_cred_xxx((task), euid)) 354 #define task_ucounts(task) (task_cred_xxx((task), ucounts)) 355 356 #define current_cred_xxx(xxx) \ 357 ({ \ 358 current_cred()->xxx; \ 359 }) 360 361 #define current_uid() (current_cred_xxx(uid)) 362 #define current_gid() (current_cred_xxx(gid)) 363 #define current_euid() (current_cred_xxx(euid)) 364 #define current_egid() (current_cred_xxx(egid)) 365 #define current_suid() (current_cred_xxx(suid)) 366 #define current_sgid() (current_cred_xxx(sgid)) 367 #define current_fsuid() (current_cred_xxx(fsuid)) 368 #define current_fsgid() (current_cred_xxx(fsgid)) 369 #define current_cap() (current_cred_xxx(cap_effective)) 370 #define current_user() (current_cred_xxx(user)) 371 #define current_ucounts() (current_cred_xxx(ucounts)) 372 373 extern struct user_namespace init_user_ns; 374 #ifdef CONFIG_USER_NS 375 #define current_user_ns() (current_cred_xxx(user_ns)) 376 #else 377 static inline struct user_namespace *current_user_ns(void) 378 { 379 return &init_user_ns; 380 } 381 #endif 382 383 384 #define current_uid_gid(_uid, _gid) \ 385 do { \ 386 const struct cred *__cred; \ 387 __cred = current_cred(); \ 388 *(_uid) = __cred->uid; \ 389 *(_gid) = __cred->gid; \ 390 } while(0) 391 392 #define current_euid_egid(_euid, _egid) \ 393 do { \ 394 const struct cred *__cred; \ 395 __cred = current_cred(); \ 396 *(_euid) = __cred->euid; \ 397 *(_egid) = __cred->egid; \ 398 } while(0) 399 400 #define current_fsuid_fsgid(_fsuid, _fsgid) \ 401 do { \ 402 const struct cred *__cred; \ 403 __cred = current_cred(); \ 404 *(_fsuid) = __cred->fsuid; \ 405 *(_fsgid) = __cred->fsgid; \ 406 } while(0) 407 408 #endif /* _LINUX_CRED_H */ 409