1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* scm.c - Socket level control messages processing. 3 * 4 * Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> 5 * Alignment and value checking mods by Craig Metz 6 */ 7 8 #include <linux/module.h> 9 #include <linux/signal.h> 10 #include <linux/capability.h> 11 #include <linux/errno.h> 12 #include <linux/sched.h> 13 #include <linux/sched/user.h> 14 #include <linux/mm.h> 15 #include <linux/kernel.h> 16 #include <linux/stat.h> 17 #include <linux/socket.h> 18 #include <linux/file.h> 19 #include <linux/fcntl.h> 20 #include <linux/net.h> 21 #include <linux/interrupt.h> 22 #include <linux/netdevice.h> 23 #include <linux/security.h> 24 #include <linux/pid_namespace.h> 25 #include <linux/pid.h> 26 #include <uapi/linux/pidfd.h> 27 #include <linux/pidfs.h> 28 #include <linux/nsproxy.h> 29 #include <linux/slab.h> 30 #include <linux/errqueue.h> 31 #include <linux/io_uring.h> 32 33 #include <linux/uaccess.h> 34 35 #include <net/protocol.h> 36 #include <linux/skbuff.h> 37 #include <net/sock.h> 38 #include <net/compat.h> 39 #include <net/scm.h> 40 #include <net/cls_cgroup.h> 41 #include <net/af_unix.h> 42 43 44 /* 45 * Only allow a user to send credentials, that they could set with 46 * setu(g)id. 47 */ 48 49 static __inline__ int scm_check_creds(struct ucred *creds) 50 { 51 const struct cred *cred = current_cred(); 52 kuid_t uid = make_kuid(cred->user_ns, creds->uid); 53 kgid_t gid = make_kgid(cred->user_ns, creds->gid); 54 55 if (!uid_valid(uid) || !gid_valid(gid)) 56 return -EINVAL; 57 58 if ((creds->pid == task_tgid_vnr(current) || 59 ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) && 60 ((uid_eq(uid, cred->uid) || uid_eq(uid, cred->euid) || 61 uid_eq(uid, cred->suid)) || ns_capable(cred->user_ns, CAP_SETUID)) && 62 ((gid_eq(gid, cred->gid) || gid_eq(gid, cred->egid) || 63 gid_eq(gid, cred->sgid)) || ns_capable(cred->user_ns, CAP_SETGID))) { 64 return 0; 65 } 66 return -EPERM; 67 } 68 69 static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) 70 { 71 int *fdp = (int*)CMSG_DATA(cmsg); 72 struct scm_fp_list *fpl = *fplp; 73 struct file **fpp; 74 int i, num; 75 76 num = (cmsg->cmsg_len - sizeof(struct cmsghdr))/sizeof(int); 77 78 if (num <= 0) 79 return 0; 80 81 if (num > SCM_MAX_FD) 82 return -EINVAL; 83 84 if (!fpl) 85 { 86 fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL_ACCOUNT); 87 if (!fpl) 88 return -ENOMEM; 89 *fplp = fpl; 90 fpl->count = 0; 91 fpl->count_unix = 0; 92 fpl->max = SCM_MAX_FD; 93 fpl->user = NULL; 94 #if IS_ENABLED(CONFIG_UNIX) 95 fpl->inflight = false; 96 fpl->dead = false; 97 fpl->edges = NULL; 98 INIT_LIST_HEAD(&fpl->vertices); 99 #endif 100 } 101 fpp = &fpl->fp[fpl->count]; 102 103 if (fpl->count + num > fpl->max) 104 return -EINVAL; 105 106 /* 107 * Verify the descriptors and increment the usage count. 108 */ 109 110 for (i=0; i< num; i++) 111 { 112 int fd = fdp[i]; 113 struct file *file; 114 115 if (fd < 0 || !(file = fget_raw(fd))) 116 return -EBADF; 117 /* don't allow io_uring files */ 118 if (io_is_uring_fops(file)) { 119 fput(file); 120 return -EINVAL; 121 } 122 if (unix_get_socket(file)) 123 fpl->count_unix++; 124 125 *fpp++ = file; 126 fpl->count++; 127 } 128 129 if (!fpl->user) 130 fpl->user = get_uid(current_user()); 131 132 return num; 133 } 134 135 void __scm_destroy(struct scm_cookie *scm) 136 { 137 struct scm_fp_list *fpl = scm->fp; 138 int i; 139 140 if (fpl) { 141 scm->fp = NULL; 142 for (i=fpl->count-1; i>=0; i--) 143 fput(fpl->fp[i]); 144 free_uid(fpl->user); 145 kfree(fpl); 146 } 147 } 148 EXPORT_SYMBOL(__scm_destroy); 149 150 static inline int scm_replace_pid(struct scm_cookie *scm, struct pid *pid) 151 { 152 int err; 153 154 /* drop all previous references */ 155 scm_destroy_cred(scm); 156 157 err = pidfs_register_pid(pid); 158 if (unlikely(err)) 159 return err; 160 161 scm->pid = pid; 162 scm->creds.pid = pid_vnr(pid); 163 return 0; 164 } 165 166 int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p) 167 { 168 const struct proto_ops *ops = READ_ONCE(sock->ops); 169 struct cmsghdr *cmsg; 170 int err; 171 172 for_each_cmsghdr(cmsg, msg) { 173 err = -EINVAL; 174 175 /* Verify that cmsg_len is at least sizeof(struct cmsghdr) */ 176 /* The first check was omitted in <= 2.2.5. The reasoning was 177 that parser checks cmsg_len in any case, so that 178 additional check would be work duplication. 179 But if cmsg_level is not SOL_SOCKET, we do not check 180 for too short ancillary data object at all! Oops. 181 OK, let's add it... 182 */ 183 if (!CMSG_OK(msg, cmsg)) 184 goto error; 185 186 if (cmsg->cmsg_level != SOL_SOCKET) 187 continue; 188 189 switch (cmsg->cmsg_type) 190 { 191 case SCM_RIGHTS: 192 if (!ops || ops->family != PF_UNIX) 193 goto error; 194 err=scm_fp_copy(cmsg, &p->fp); 195 if (err<0) 196 goto error; 197 break; 198 case SCM_CREDENTIALS: 199 { 200 struct ucred creds; 201 kuid_t uid; 202 kgid_t gid; 203 if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred))) 204 goto error; 205 memcpy(&creds, CMSG_DATA(cmsg), sizeof(struct ucred)); 206 err = scm_check_creds(&creds); 207 if (err) 208 goto error; 209 210 if (!p->pid || pid_vnr(p->pid) != creds.pid) { 211 struct pid *pid; 212 err = -ESRCH; 213 pid = find_get_pid(creds.pid); 214 if (!pid) 215 goto error; 216 217 /* pass a struct pid reference from 218 * find_get_pid() to scm_replace_pid(). 219 */ 220 err = scm_replace_pid(p, pid); 221 if (err) { 222 put_pid(pid); 223 goto error; 224 } 225 } 226 227 err = -EINVAL; 228 uid = make_kuid(current_user_ns(), creds.uid); 229 gid = make_kgid(current_user_ns(), creds.gid); 230 if (!uid_valid(uid) || !gid_valid(gid)) 231 goto error; 232 233 p->creds.uid = uid; 234 p->creds.gid = gid; 235 break; 236 } 237 default: 238 goto error; 239 } 240 } 241 242 if (p->fp && !p->fp->count) 243 { 244 kfree(p->fp); 245 p->fp = NULL; 246 } 247 return 0; 248 249 error: 250 scm_destroy(p); 251 return err; 252 } 253 EXPORT_SYMBOL(__scm_send); 254 255 int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data) 256 { 257 int cmlen = CMSG_LEN(len); 258 259 if (msg->msg_flags & MSG_CMSG_COMPAT) 260 return put_cmsg_compat(msg, level, type, len, data); 261 262 if (!msg->msg_control || msg->msg_controllen < sizeof(struct cmsghdr)) { 263 msg->msg_flags |= MSG_CTRUNC; 264 return 0; /* XXX: return error? check spec. */ 265 } 266 if (msg->msg_controllen < cmlen) { 267 msg->msg_flags |= MSG_CTRUNC; 268 cmlen = msg->msg_controllen; 269 } 270 271 if (msg->msg_control_is_user) { 272 struct cmsghdr __user *cm = msg->msg_control_user; 273 274 check_object_size(data, cmlen - sizeof(*cm), true); 275 276 if (can_do_masked_user_access()) 277 cm = masked_user_access_begin(cm); 278 else if (!user_write_access_begin(cm, cmlen)) 279 goto efault; 280 281 unsafe_put_user(cmlen, &cm->cmsg_len, efault_end); 282 unsafe_put_user(level, &cm->cmsg_level, efault_end); 283 unsafe_put_user(type, &cm->cmsg_type, efault_end); 284 unsafe_copy_to_user(CMSG_USER_DATA(cm), data, 285 cmlen - sizeof(*cm), efault_end); 286 user_write_access_end(); 287 } else { 288 struct cmsghdr *cm = msg->msg_control; 289 290 cm->cmsg_level = level; 291 cm->cmsg_type = type; 292 cm->cmsg_len = cmlen; 293 memcpy(CMSG_DATA(cm), data, cmlen - sizeof(*cm)); 294 } 295 296 cmlen = min(CMSG_SPACE(len), msg->msg_controllen); 297 if (msg->msg_control_is_user) 298 msg->msg_control_user += cmlen; 299 else 300 msg->msg_control += cmlen; 301 msg->msg_controllen -= cmlen; 302 return 0; 303 304 efault_end: 305 user_write_access_end(); 306 efault: 307 return -EFAULT; 308 } 309 EXPORT_SYMBOL(put_cmsg); 310 311 int put_cmsg_notrunc(struct msghdr *msg, int level, int type, int len, 312 void *data) 313 { 314 /* Don't produce truncated CMSGs */ 315 if (!msg->msg_control || msg->msg_controllen < CMSG_LEN(len)) 316 return -ETOOSMALL; 317 318 return put_cmsg(msg, level, type, len, data); 319 } 320 321 void put_cmsg_scm_timestamping64(struct msghdr *msg, struct scm_timestamping_internal *tss_internal) 322 { 323 struct scm_timestamping64 tss; 324 int i; 325 326 for (i = 0; i < ARRAY_SIZE(tss.ts); i++) { 327 tss.ts[i].tv_sec = tss_internal->ts[i].tv_sec; 328 tss.ts[i].tv_nsec = tss_internal->ts[i].tv_nsec; 329 } 330 331 put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPING_NEW, sizeof(tss), &tss); 332 } 333 EXPORT_SYMBOL(put_cmsg_scm_timestamping64); 334 335 void put_cmsg_scm_timestamping(struct msghdr *msg, struct scm_timestamping_internal *tss_internal) 336 { 337 struct scm_timestamping tss; 338 int i; 339 340 for (i = 0; i < ARRAY_SIZE(tss.ts); i++) { 341 tss.ts[i].tv_sec = tss_internal->ts[i].tv_sec; 342 tss.ts[i].tv_nsec = tss_internal->ts[i].tv_nsec; 343 } 344 345 put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPING_OLD, sizeof(tss), &tss); 346 } 347 EXPORT_SYMBOL(put_cmsg_scm_timestamping); 348 349 static int scm_max_fds(struct msghdr *msg) 350 { 351 if (msg->msg_controllen <= sizeof(struct cmsghdr)) 352 return 0; 353 return (msg->msg_controllen - sizeof(struct cmsghdr)) / sizeof(int); 354 } 355 356 void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm) 357 { 358 struct cmsghdr __user *cm = 359 (__force struct cmsghdr __user *)msg->msg_control_user; 360 unsigned int o_flags = (msg->msg_flags & MSG_CMSG_CLOEXEC) ? O_CLOEXEC : 0; 361 int fdmax = min_t(int, scm_max_fds(msg), scm->fp->count); 362 int __user *cmsg_data = CMSG_USER_DATA(cm); 363 int err = 0, i; 364 365 /* no use for FD passing from kernel space callers */ 366 if (WARN_ON_ONCE(!msg->msg_control_is_user)) 367 return; 368 369 if (msg->msg_flags & MSG_CMSG_COMPAT) { 370 scm_detach_fds_compat(msg, scm); 371 return; 372 } 373 374 for (i = 0; i < fdmax; i++) { 375 err = scm_recv_one_fd(scm->fp->fp[i], cmsg_data + i, o_flags); 376 if (err < 0) 377 break; 378 } 379 380 if (i > 0) { 381 int cmlen = CMSG_LEN(i * sizeof(int)); 382 383 err = put_user(SOL_SOCKET, &cm->cmsg_level); 384 if (!err) 385 err = put_user(SCM_RIGHTS, &cm->cmsg_type); 386 if (!err) 387 err = put_user(cmlen, &cm->cmsg_len); 388 if (!err) { 389 cmlen = CMSG_SPACE(i * sizeof(int)); 390 if (msg->msg_controllen < cmlen) 391 cmlen = msg->msg_controllen; 392 msg->msg_control_user += cmlen; 393 msg->msg_controllen -= cmlen; 394 } 395 } 396 397 if (i < scm->fp->count || (scm->fp->count && fdmax <= 0)) 398 msg->msg_flags |= MSG_CTRUNC; 399 400 /* 401 * All of the files that fit in the message have had their usage counts 402 * incremented, so we just free the list. 403 */ 404 __scm_destroy(scm); 405 } 406 EXPORT_SYMBOL(scm_detach_fds); 407 408 struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl) 409 { 410 struct scm_fp_list *new_fpl; 411 int i; 412 413 if (!fpl) 414 return NULL; 415 416 new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]), 417 GFP_KERNEL_ACCOUNT); 418 if (new_fpl) { 419 for (i = 0; i < fpl->count; i++) 420 get_file(fpl->fp[i]); 421 422 new_fpl->max = new_fpl->count; 423 new_fpl->user = get_uid(fpl->user); 424 #if IS_ENABLED(CONFIG_UNIX) 425 new_fpl->inflight = false; 426 new_fpl->edges = NULL; 427 INIT_LIST_HEAD(&new_fpl->vertices); 428 #endif 429 } 430 return new_fpl; 431 } 432 EXPORT_SYMBOL(scm_fp_dup); 433 434 #ifdef CONFIG_SECURITY_NETWORK 435 static void scm_passec(struct sock *sk, struct msghdr *msg, struct scm_cookie *scm) 436 { 437 struct lsm_context ctx; 438 int err; 439 440 if (sk->sk_scm_security) { 441 err = security_secid_to_secctx(scm->secid, &ctx); 442 443 if (err >= 0) { 444 put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, ctx.len, 445 ctx.context); 446 447 security_release_secctx(&ctx); 448 } 449 } 450 } 451 452 static bool scm_has_secdata(struct sock *sk) 453 { 454 return sk->sk_scm_security; 455 } 456 #else 457 static void scm_passec(struct sock *sk, struct msghdr *msg, struct scm_cookie *scm) 458 { 459 } 460 461 static bool scm_has_secdata(struct sock *sk) 462 { 463 return false; 464 } 465 #endif 466 467 static void scm_pidfd_recv(struct msghdr *msg, struct scm_cookie *scm) 468 { 469 struct file *pidfd_file = NULL; 470 int len, pidfd; 471 472 /* put_cmsg() doesn't return an error if CMSG is truncated, 473 * that's why we need to opencode these checks here. 474 */ 475 if (msg->msg_flags & MSG_CMSG_COMPAT) 476 len = sizeof(struct compat_cmsghdr) + sizeof(int); 477 else 478 len = sizeof(struct cmsghdr) + sizeof(int); 479 480 if (msg->msg_controllen < len) { 481 msg->msg_flags |= MSG_CTRUNC; 482 return; 483 } 484 485 if (!scm->pid) 486 return; 487 488 pidfd = pidfd_prepare(scm->pid, PIDFD_STALE, &pidfd_file); 489 490 if (put_cmsg(msg, SOL_SOCKET, SCM_PIDFD, sizeof(int), &pidfd)) { 491 if (pidfd_file) { 492 put_unused_fd(pidfd); 493 fput(pidfd_file); 494 } 495 496 return; 497 } 498 499 if (pidfd_file) 500 fd_install(pidfd, pidfd_file); 501 } 502 503 static bool __scm_recv_common(struct sock *sk, struct msghdr *msg, 504 struct scm_cookie *scm, int flags) 505 { 506 if (!msg->msg_control) { 507 if (sk->sk_scm_credentials || sk->sk_scm_pidfd || 508 scm->fp || scm_has_secdata(sk)) 509 msg->msg_flags |= MSG_CTRUNC; 510 511 scm_destroy(scm); 512 return false; 513 } 514 515 if (sk->sk_scm_credentials) { 516 struct user_namespace *current_ns = current_user_ns(); 517 struct ucred ucreds = { 518 .pid = scm->creds.pid, 519 .uid = from_kuid_munged(current_ns, scm->creds.uid), 520 .gid = from_kgid_munged(current_ns, scm->creds.gid), 521 }; 522 523 put_cmsg(msg, SOL_SOCKET, SCM_CREDENTIALS, sizeof(ucreds), &ucreds); 524 } 525 526 scm_passec(sk, msg, scm); 527 528 if (scm->fp) 529 scm_detach_fds(msg, scm); 530 531 return true; 532 } 533 534 void scm_recv(struct socket *sock, struct msghdr *msg, 535 struct scm_cookie *scm, int flags) 536 { 537 if (!__scm_recv_common(sock->sk, msg, scm, flags)) 538 return; 539 540 scm_destroy_cred(scm); 541 } 542 EXPORT_SYMBOL(scm_recv); 543 544 void scm_recv_unix(struct socket *sock, struct msghdr *msg, 545 struct scm_cookie *scm, int flags) 546 { 547 if (!__scm_recv_common(sock->sk, msg, scm, flags)) 548 return; 549 550 if (sock->sk->sk_scm_pidfd) 551 scm_pidfd_recv(msg, scm); 552 553 scm_destroy_cred(scm); 554 } 555