xref: /freebsd/sys/kern/kern_prot.c (revision 1db64f89363c97858961c4df0b7d02f3223723cf)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1989, 1990, 1991, 1993
5  *	The Regents of the University of California.
6  * (c) UNIX System Laboratories, Inc.
7  * Copyright (c) 2000-2001 Robert N. M. Watson.
8  * All rights reserved.
9  *
10  * All or some portions of this file are derived from material licensed
11  * to the University of California by American Telephone and Telegraph
12  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
13  * the permission of UNIX System Laboratories, Inc.
14  *
15  * Redistribution and use in source and binary forms, with or without
16  * modification, are permitted provided that the following conditions
17  * are met:
18  * 1. Redistributions of source code must retain the above copyright
19  *    notice, this list of conditions and the following disclaimer.
20  * 2. Redistributions in binary form must reproduce the above copyright
21  *    notice, this list of conditions and the following disclaimer in the
22  *    documentation and/or other materials provided with the distribution.
23  * 3. Neither the name of the University nor the names of its contributors
24  *    may be used to endorse or promote products derived from this software
25  *    without specific prior written permission.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
28  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
29  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
30  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
31  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
32  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
33  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
34  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
35  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
36  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37  * SUCH DAMAGE.
38  */
39 
40 /*
41  * System calls related to processes and protection
42  */
43 
44 #include <sys/cdefs.h>
45 #include "opt_inet.h"
46 #include "opt_inet6.h"
47 
48 #include <sys/param.h>
49 #include <sys/systm.h>
50 #include <sys/acct.h>
51 #include <sys/kdb.h>
52 #include <sys/kernel.h>
53 #include <sys/lock.h>
54 #include <sys/loginclass.h>
55 #include <sys/malloc.h>
56 #include <sys/mutex.h>
57 #include <sys/ptrace.h>
58 #include <sys/refcount.h>
59 #include <sys/sx.h>
60 #include <sys/priv.h>
61 #include <sys/proc.h>
62 #ifdef COMPAT_43
63 #include <sys/sysent.h>
64 #endif
65 #include <sys/sysproto.h>
66 #include <sys/jail.h>
67 #include <sys/racct.h>
68 #include <sys/rctl.h>
69 #include <sys/resourcevar.h>
70 #include <sys/socket.h>
71 #include <sys/socketvar.h>
72 #include <sys/syscallsubr.h>
73 #include <sys/sysctl.h>
74 
75 #ifdef REGRESSION
76 FEATURE(regression,
77     "Kernel support for interfaces necessary for regression testing (SECURITY RISK!)");
78 #endif
79 
80 #include <security/audit/audit.h>
81 #include <security/mac/mac_framework.h>
82 
83 static MALLOC_DEFINE(M_CRED, "cred", "credentials");
84 
85 SYSCTL_NODE(_security, OID_AUTO, bsd, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
86     "BSD security policy");
87 
88 static void crfree_final(struct ucred *cr);
89 static void crsetgroups_locked(struct ucred *cr, int ngrp,
90     gid_t *groups);
91 
92 static int cr_canseeotheruids(struct ucred *u1, struct ucred *u2);
93 static int cr_canseeothergids(struct ucred *u1, struct ucred *u2);
94 static int cr_canseejailproc(struct ucred *u1, struct ucred *u2);
95 
96 #ifndef _SYS_SYSPROTO_H_
97 struct getpid_args {
98 	int	dummy;
99 };
100 #endif
101 /* ARGSUSED */
102 int
103 sys_getpid(struct thread *td, struct getpid_args *uap)
104 {
105 	struct proc *p = td->td_proc;
106 
107 	td->td_retval[0] = p->p_pid;
108 #if defined(COMPAT_43)
109 	if (SV_PROC_FLAG(p, SV_AOUT))
110 		td->td_retval[1] = kern_getppid(td);
111 #endif
112 	return (0);
113 }
114 
115 #ifndef _SYS_SYSPROTO_H_
116 struct getppid_args {
117         int     dummy;
118 };
119 #endif
120 /* ARGSUSED */
121 int
122 sys_getppid(struct thread *td, struct getppid_args *uap)
123 {
124 
125 	td->td_retval[0] = kern_getppid(td);
126 	return (0);
127 }
128 
129 int
130 kern_getppid(struct thread *td)
131 {
132 	struct proc *p = td->td_proc;
133 
134 	return (p->p_oppid);
135 }
136 
137 /*
138  * Get process group ID; note that POSIX getpgrp takes no parameter.
139  */
140 #ifndef _SYS_SYSPROTO_H_
141 struct getpgrp_args {
142         int     dummy;
143 };
144 #endif
145 int
146 sys_getpgrp(struct thread *td, struct getpgrp_args *uap)
147 {
148 	struct proc *p = td->td_proc;
149 
150 	PROC_LOCK(p);
151 	td->td_retval[0] = p->p_pgrp->pg_id;
152 	PROC_UNLOCK(p);
153 	return (0);
154 }
155 
156 /* Get an arbitrary pid's process group id */
157 #ifndef _SYS_SYSPROTO_H_
158 struct getpgid_args {
159 	pid_t	pid;
160 };
161 #endif
162 int
163 sys_getpgid(struct thread *td, struct getpgid_args *uap)
164 {
165 	struct proc *p;
166 	int error;
167 
168 	if (uap->pid == 0) {
169 		p = td->td_proc;
170 		PROC_LOCK(p);
171 	} else {
172 		p = pfind(uap->pid);
173 		if (p == NULL)
174 			return (ESRCH);
175 		error = p_cansee(td, p);
176 		if (error) {
177 			PROC_UNLOCK(p);
178 			return (error);
179 		}
180 	}
181 	td->td_retval[0] = p->p_pgrp->pg_id;
182 	PROC_UNLOCK(p);
183 	return (0);
184 }
185 
186 /*
187  * Get an arbitrary pid's session id.
188  */
189 #ifndef _SYS_SYSPROTO_H_
190 struct getsid_args {
191 	pid_t	pid;
192 };
193 #endif
194 int
195 sys_getsid(struct thread *td, struct getsid_args *uap)
196 {
197 
198 	return (kern_getsid(td, uap->pid));
199 }
200 
201 int
202 kern_getsid(struct thread *td, pid_t pid)
203 {
204 	struct proc *p;
205 	int error;
206 
207 	if (pid == 0) {
208 		p = td->td_proc;
209 		PROC_LOCK(p);
210 	} else {
211 		p = pfind(pid);
212 		if (p == NULL)
213 			return (ESRCH);
214 		error = p_cansee(td, p);
215 		if (error) {
216 			PROC_UNLOCK(p);
217 			return (error);
218 		}
219 	}
220 	td->td_retval[0] = p->p_session->s_sid;
221 	PROC_UNLOCK(p);
222 	return (0);
223 }
224 
225 #ifndef _SYS_SYSPROTO_H_
226 struct getuid_args {
227         int     dummy;
228 };
229 #endif
230 /* ARGSUSED */
231 int
232 sys_getuid(struct thread *td, struct getuid_args *uap)
233 {
234 
235 	td->td_retval[0] = td->td_ucred->cr_ruid;
236 #if defined(COMPAT_43)
237 	td->td_retval[1] = td->td_ucred->cr_uid;
238 #endif
239 	return (0);
240 }
241 
242 #ifndef _SYS_SYSPROTO_H_
243 struct geteuid_args {
244         int     dummy;
245 };
246 #endif
247 /* ARGSUSED */
248 int
249 sys_geteuid(struct thread *td, struct geteuid_args *uap)
250 {
251 
252 	td->td_retval[0] = td->td_ucred->cr_uid;
253 	return (0);
254 }
255 
256 #ifndef _SYS_SYSPROTO_H_
257 struct getgid_args {
258         int     dummy;
259 };
260 #endif
261 /* ARGSUSED */
262 int
263 sys_getgid(struct thread *td, struct getgid_args *uap)
264 {
265 
266 	td->td_retval[0] = td->td_ucred->cr_rgid;
267 #if defined(COMPAT_43)
268 	td->td_retval[1] = td->td_ucred->cr_groups[0];
269 #endif
270 	return (0);
271 }
272 
273 /*
274  * Get effective group ID.  The "egid" is groups[0], and could be obtained
275  * via getgroups.  This syscall exists because it is somewhat painful to do
276  * correctly in a library function.
277  */
278 #ifndef _SYS_SYSPROTO_H_
279 struct getegid_args {
280         int     dummy;
281 };
282 #endif
283 /* ARGSUSED */
284 int
285 sys_getegid(struct thread *td, struct getegid_args *uap)
286 {
287 
288 	td->td_retval[0] = td->td_ucred->cr_groups[0];
289 	return (0);
290 }
291 
292 #ifndef _SYS_SYSPROTO_H_
293 struct getgroups_args {
294 	int	gidsetsize;
295 	gid_t	*gidset;
296 };
297 #endif
298 int
299 sys_getgroups(struct thread *td, struct getgroups_args *uap)
300 {
301 	struct ucred *cred;
302 	int ngrp, error;
303 
304 	cred = td->td_ucred;
305 	ngrp = cred->cr_ngroups;
306 
307 	if (uap->gidsetsize == 0) {
308 		error = 0;
309 		goto out;
310 	}
311 	if (uap->gidsetsize < ngrp)
312 		return (EINVAL);
313 
314 	error = copyout(cred->cr_groups, uap->gidset, ngrp * sizeof(gid_t));
315 out:
316 	td->td_retval[0] = ngrp;
317 	return (error);
318 }
319 
320 #ifndef _SYS_SYSPROTO_H_
321 struct setsid_args {
322         int     dummy;
323 };
324 #endif
325 /* ARGSUSED */
326 int
327 sys_setsid(struct thread *td, struct setsid_args *uap)
328 {
329 	struct pgrp *pgrp;
330 	int error;
331 	struct proc *p = td->td_proc;
332 	struct pgrp *newpgrp;
333 	struct session *newsess;
334 
335 	pgrp = NULL;
336 
337 	newpgrp = uma_zalloc(pgrp_zone, M_WAITOK);
338 	newsess = malloc(sizeof(struct session), M_SESSION, M_WAITOK | M_ZERO);
339 
340 again:
341 	error = 0;
342 	sx_xlock(&proctree_lock);
343 
344 	if (p->p_pgid == p->p_pid || (pgrp = pgfind(p->p_pid)) != NULL) {
345 		if (pgrp != NULL)
346 			PGRP_UNLOCK(pgrp);
347 		error = EPERM;
348 	} else {
349 		error = enterpgrp(p, p->p_pid, newpgrp, newsess);
350 		if (error == ERESTART)
351 			goto again;
352 		MPASS(error == 0);
353 		td->td_retval[0] = p->p_pid;
354 		newpgrp = NULL;
355 		newsess = NULL;
356 	}
357 
358 	sx_xunlock(&proctree_lock);
359 
360 	uma_zfree(pgrp_zone, newpgrp);
361 	free(newsess, M_SESSION);
362 
363 	return (error);
364 }
365 
366 /*
367  * set process group (setpgid/old setpgrp)
368  *
369  * caller does setpgid(targpid, targpgid)
370  *
371  * pid must be caller or child of caller (ESRCH)
372  * if a child
373  *	pid must be in same session (EPERM)
374  *	pid can't have done an exec (EACCES)
375  * if pgid != pid
376  * 	there must exist some pid in same session having pgid (EPERM)
377  * pid must not be session leader (EPERM)
378  */
379 #ifndef _SYS_SYSPROTO_H_
380 struct setpgid_args {
381 	int	pid;		/* target process id */
382 	int	pgid;		/* target pgrp id */
383 };
384 #endif
385 /* ARGSUSED */
386 int
387 sys_setpgid(struct thread *td, struct setpgid_args *uap)
388 {
389 	struct proc *curp = td->td_proc;
390 	struct proc *targp;	/* target process */
391 	struct pgrp *pgrp;	/* target pgrp */
392 	int error;
393 	struct pgrp *newpgrp;
394 
395 	if (uap->pgid < 0)
396 		return (EINVAL);
397 
398 	newpgrp = uma_zalloc(pgrp_zone, M_WAITOK);
399 
400 again:
401 	error = 0;
402 
403 	sx_xlock(&proctree_lock);
404 	if (uap->pid != 0 && uap->pid != curp->p_pid) {
405 		if ((targp = pfind(uap->pid)) == NULL) {
406 			error = ESRCH;
407 			goto done;
408 		}
409 		if (!inferior(targp)) {
410 			PROC_UNLOCK(targp);
411 			error = ESRCH;
412 			goto done;
413 		}
414 		if ((error = p_cansee(td, targp))) {
415 			PROC_UNLOCK(targp);
416 			goto done;
417 		}
418 		if (targp->p_pgrp == NULL ||
419 		    targp->p_session != curp->p_session) {
420 			PROC_UNLOCK(targp);
421 			error = EPERM;
422 			goto done;
423 		}
424 		if (targp->p_flag & P_EXEC) {
425 			PROC_UNLOCK(targp);
426 			error = EACCES;
427 			goto done;
428 		}
429 		PROC_UNLOCK(targp);
430 	} else
431 		targp = curp;
432 	if (SESS_LEADER(targp)) {
433 		error = EPERM;
434 		goto done;
435 	}
436 	if (uap->pgid == 0)
437 		uap->pgid = targp->p_pid;
438 	if ((pgrp = pgfind(uap->pgid)) == NULL) {
439 		if (uap->pgid == targp->p_pid) {
440 			error = enterpgrp(targp, uap->pgid, newpgrp,
441 			    NULL);
442 			if (error == 0)
443 				newpgrp = NULL;
444 		} else
445 			error = EPERM;
446 	} else {
447 		if (pgrp == targp->p_pgrp) {
448 			PGRP_UNLOCK(pgrp);
449 			goto done;
450 		}
451 		if (pgrp->pg_id != targp->p_pid &&
452 		    pgrp->pg_session != curp->p_session) {
453 			PGRP_UNLOCK(pgrp);
454 			error = EPERM;
455 			goto done;
456 		}
457 		PGRP_UNLOCK(pgrp);
458 		error = enterthispgrp(targp, pgrp);
459 	}
460 done:
461 	KASSERT(error == 0 || newpgrp != NULL,
462 	    ("setpgid failed and newpgrp is NULL"));
463 	if (error == ERESTART)
464 		goto again;
465 	sx_xunlock(&proctree_lock);
466 	uma_zfree(pgrp_zone, newpgrp);
467 	return (error);
468 }
469 
470 /*
471  * Use the clause in B.4.2.2 that allows setuid/setgid to be 4.2/4.3BSD
472  * compatible.  It says that setting the uid/gid to euid/egid is a special
473  * case of "appropriate privilege".  Once the rules are expanded out, this
474  * basically means that setuid(nnn) sets all three id's, in all permitted
475  * cases unless _POSIX_SAVED_IDS is enabled.  In that case, setuid(getuid())
476  * does not set the saved id - this is dangerous for traditional BSD
477  * programs.  For this reason, we *really* do not want to set
478  * _POSIX_SAVED_IDS and do not want to clear POSIX_APPENDIX_B_4_2_2.
479  */
480 #define POSIX_APPENDIX_B_4_2_2
481 
482 #ifndef _SYS_SYSPROTO_H_
483 struct setuid_args {
484 	uid_t	uid;
485 };
486 #endif
487 /* ARGSUSED */
488 int
489 sys_setuid(struct thread *td, struct setuid_args *uap)
490 {
491 	struct proc *p = td->td_proc;
492 	struct ucred *newcred, *oldcred;
493 	uid_t uid;
494 	struct uidinfo *uip;
495 	int error;
496 
497 	uid = uap->uid;
498 	AUDIT_ARG_UID(uid);
499 	newcred = crget();
500 	uip = uifind(uid);
501 	PROC_LOCK(p);
502 	/*
503 	 * Copy credentials so other references do not see our changes.
504 	 */
505 	oldcred = crcopysafe(p, newcred);
506 
507 #ifdef MAC
508 	error = mac_cred_check_setuid(oldcred, uid);
509 	if (error)
510 		goto fail;
511 #endif
512 
513 	/*
514 	 * See if we have "permission" by POSIX 1003.1 rules.
515 	 *
516 	 * Note that setuid(geteuid()) is a special case of
517 	 * "appropriate privileges" in appendix B.4.2.2.  We need
518 	 * to use this clause to be compatible with traditional BSD
519 	 * semantics.  Basically, it means that "setuid(xx)" sets all
520 	 * three id's (assuming you have privs).
521 	 *
522 	 * Notes on the logic.  We do things in three steps.
523 	 * 1: We determine if the euid is going to change, and do EPERM
524 	 *    right away.  We unconditionally change the euid later if this
525 	 *    test is satisfied, simplifying that part of the logic.
526 	 * 2: We determine if the real and/or saved uids are going to
527 	 *    change.  Determined by compile options.
528 	 * 3: Change euid last. (after tests in #2 for "appropriate privs")
529 	 */
530 	if (uid != oldcred->cr_ruid &&		/* allow setuid(getuid()) */
531 #ifdef _POSIX_SAVED_IDS
532 	    uid != oldcred->cr_svuid &&		/* allow setuid(saved gid) */
533 #endif
534 #ifdef POSIX_APPENDIX_B_4_2_2	/* Use BSD-compat clause from B.4.2.2 */
535 	    uid != oldcred->cr_uid &&		/* allow setuid(geteuid()) */
536 #endif
537 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETUID)) != 0)
538 		goto fail;
539 
540 #ifdef _POSIX_SAVED_IDS
541 	/*
542 	 * Do we have "appropriate privileges" (are we root or uid == euid)
543 	 * If so, we are changing the real uid and/or saved uid.
544 	 */
545 	if (
546 #ifdef POSIX_APPENDIX_B_4_2_2	/* Use the clause from B.4.2.2 */
547 	    uid == oldcred->cr_uid ||
548 #endif
549 	    /* We are using privs. */
550 	    priv_check_cred(oldcred, PRIV_CRED_SETUID) == 0)
551 #endif
552 	{
553 		/*
554 		 * Set the real uid and transfer proc count to new user.
555 		 */
556 		if (uid != oldcred->cr_ruid) {
557 			change_ruid(newcred, uip);
558 			setsugid(p);
559 		}
560 		/*
561 		 * Set saved uid
562 		 *
563 		 * XXX always set saved uid even if not _POSIX_SAVED_IDS, as
564 		 * the security of seteuid() depends on it.  B.4.2.2 says it
565 		 * is important that we should do this.
566 		 */
567 		if (uid != oldcred->cr_svuid) {
568 			change_svuid(newcred, uid);
569 			setsugid(p);
570 		}
571 	}
572 
573 	/*
574 	 * In all permitted cases, we are changing the euid.
575 	 */
576 	if (uid != oldcred->cr_uid) {
577 		change_euid(newcred, uip);
578 		setsugid(p);
579 	}
580 	proc_set_cred(p, newcred);
581 #ifdef RACCT
582 	racct_proc_ucred_changed(p, oldcred, newcred);
583 	crhold(newcred);
584 #endif
585 	PROC_UNLOCK(p);
586 #ifdef RCTL
587 	rctl_proc_ucred_changed(p, newcred);
588 	crfree(newcred);
589 #endif
590 	uifree(uip);
591 	crfree(oldcred);
592 	return (0);
593 
594 fail:
595 	PROC_UNLOCK(p);
596 	uifree(uip);
597 	crfree(newcred);
598 	return (error);
599 }
600 
601 #ifndef _SYS_SYSPROTO_H_
602 struct seteuid_args {
603 	uid_t	euid;
604 };
605 #endif
606 /* ARGSUSED */
607 int
608 sys_seteuid(struct thread *td, struct seteuid_args *uap)
609 {
610 	struct proc *p = td->td_proc;
611 	struct ucred *newcred, *oldcred;
612 	uid_t euid;
613 	struct uidinfo *euip;
614 	int error;
615 
616 	euid = uap->euid;
617 	AUDIT_ARG_EUID(euid);
618 	newcred = crget();
619 	euip = uifind(euid);
620 	PROC_LOCK(p);
621 	/*
622 	 * Copy credentials so other references do not see our changes.
623 	 */
624 	oldcred = crcopysafe(p, newcred);
625 
626 #ifdef MAC
627 	error = mac_cred_check_seteuid(oldcred, euid);
628 	if (error)
629 		goto fail;
630 #endif
631 
632 	if (euid != oldcred->cr_ruid &&		/* allow seteuid(getuid()) */
633 	    euid != oldcred->cr_svuid &&	/* allow seteuid(saved uid) */
634 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETEUID)) != 0)
635 		goto fail;
636 
637 	/*
638 	 * Everything's okay, do it.
639 	 */
640 	if (oldcred->cr_uid != euid) {
641 		change_euid(newcred, euip);
642 		setsugid(p);
643 	}
644 	proc_set_cred(p, newcred);
645 	PROC_UNLOCK(p);
646 	uifree(euip);
647 	crfree(oldcred);
648 	return (0);
649 
650 fail:
651 	PROC_UNLOCK(p);
652 	uifree(euip);
653 	crfree(newcred);
654 	return (error);
655 }
656 
657 #ifndef _SYS_SYSPROTO_H_
658 struct setgid_args {
659 	gid_t	gid;
660 };
661 #endif
662 /* ARGSUSED */
663 int
664 sys_setgid(struct thread *td, struct setgid_args *uap)
665 {
666 	struct proc *p = td->td_proc;
667 	struct ucred *newcred, *oldcred;
668 	gid_t gid;
669 	int error;
670 
671 	gid = uap->gid;
672 	AUDIT_ARG_GID(gid);
673 	newcred = crget();
674 	PROC_LOCK(p);
675 	oldcred = crcopysafe(p, newcred);
676 
677 #ifdef MAC
678 	error = mac_cred_check_setgid(oldcred, gid);
679 	if (error)
680 		goto fail;
681 #endif
682 
683 	/*
684 	 * See if we have "permission" by POSIX 1003.1 rules.
685 	 *
686 	 * Note that setgid(getegid()) is a special case of
687 	 * "appropriate privileges" in appendix B.4.2.2.  We need
688 	 * to use this clause to be compatible with traditional BSD
689 	 * semantics.  Basically, it means that "setgid(xx)" sets all
690 	 * three id's (assuming you have privs).
691 	 *
692 	 * For notes on the logic here, see setuid() above.
693 	 */
694 	if (gid != oldcred->cr_rgid &&		/* allow setgid(getgid()) */
695 #ifdef _POSIX_SAVED_IDS
696 	    gid != oldcred->cr_svgid &&		/* allow setgid(saved gid) */
697 #endif
698 #ifdef POSIX_APPENDIX_B_4_2_2	/* Use BSD-compat clause from B.4.2.2 */
699 	    gid != oldcred->cr_groups[0] && /* allow setgid(getegid()) */
700 #endif
701 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETGID)) != 0)
702 		goto fail;
703 
704 #ifdef _POSIX_SAVED_IDS
705 	/*
706 	 * Do we have "appropriate privileges" (are we root or gid == egid)
707 	 * If so, we are changing the real uid and saved gid.
708 	 */
709 	if (
710 #ifdef POSIX_APPENDIX_B_4_2_2	/* use the clause from B.4.2.2 */
711 	    gid == oldcred->cr_groups[0] ||
712 #endif
713 	    /* We are using privs. */
714 	    priv_check_cred(oldcred, PRIV_CRED_SETGID) == 0)
715 #endif
716 	{
717 		/*
718 		 * Set real gid
719 		 */
720 		if (oldcred->cr_rgid != gid) {
721 			change_rgid(newcred, gid);
722 			setsugid(p);
723 		}
724 		/*
725 		 * Set saved gid
726 		 *
727 		 * XXX always set saved gid even if not _POSIX_SAVED_IDS, as
728 		 * the security of setegid() depends on it.  B.4.2.2 says it
729 		 * is important that we should do this.
730 		 */
731 		if (oldcred->cr_svgid != gid) {
732 			change_svgid(newcred, gid);
733 			setsugid(p);
734 		}
735 	}
736 	/*
737 	 * In all cases permitted cases, we are changing the egid.
738 	 * Copy credentials so other references do not see our changes.
739 	 */
740 	if (oldcred->cr_groups[0] != gid) {
741 		change_egid(newcred, gid);
742 		setsugid(p);
743 	}
744 	proc_set_cred(p, newcred);
745 	PROC_UNLOCK(p);
746 	crfree(oldcred);
747 	return (0);
748 
749 fail:
750 	PROC_UNLOCK(p);
751 	crfree(newcred);
752 	return (error);
753 }
754 
755 #ifndef _SYS_SYSPROTO_H_
756 struct setegid_args {
757 	gid_t	egid;
758 };
759 #endif
760 /* ARGSUSED */
761 int
762 sys_setegid(struct thread *td, struct setegid_args *uap)
763 {
764 	struct proc *p = td->td_proc;
765 	struct ucred *newcred, *oldcred;
766 	gid_t egid;
767 	int error;
768 
769 	egid = uap->egid;
770 	AUDIT_ARG_EGID(egid);
771 	newcred = crget();
772 	PROC_LOCK(p);
773 	oldcred = crcopysafe(p, newcred);
774 
775 #ifdef MAC
776 	error = mac_cred_check_setegid(oldcred, egid);
777 	if (error)
778 		goto fail;
779 #endif
780 
781 	if (egid != oldcred->cr_rgid &&		/* allow setegid(getgid()) */
782 	    egid != oldcred->cr_svgid &&	/* allow setegid(saved gid) */
783 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETEGID)) != 0)
784 		goto fail;
785 
786 	if (oldcred->cr_groups[0] != egid) {
787 		change_egid(newcred, egid);
788 		setsugid(p);
789 	}
790 	proc_set_cred(p, newcred);
791 	PROC_UNLOCK(p);
792 	crfree(oldcred);
793 	return (0);
794 
795 fail:
796 	PROC_UNLOCK(p);
797 	crfree(newcred);
798 	return (error);
799 }
800 
801 #ifndef _SYS_SYSPROTO_H_
802 struct setgroups_args {
803 	int	gidsetsize;
804 	gid_t	*gidset;
805 };
806 #endif
807 /* ARGSUSED */
808 int
809 sys_setgroups(struct thread *td, struct setgroups_args *uap)
810 {
811 	gid_t smallgroups[XU_NGROUPS];
812 	gid_t *groups;
813 	int gidsetsize, error;
814 
815 	gidsetsize = uap->gidsetsize;
816 	if (gidsetsize > ngroups_max + 1 || gidsetsize < 0)
817 		return (EINVAL);
818 
819 	if (gidsetsize > XU_NGROUPS)
820 		groups = malloc(gidsetsize * sizeof(gid_t), M_TEMP, M_WAITOK);
821 	else
822 		groups = smallgroups;
823 
824 	error = copyin(uap->gidset, groups, gidsetsize * sizeof(gid_t));
825 	if (error == 0)
826 		error = kern_setgroups(td, gidsetsize, groups);
827 
828 	if (gidsetsize > XU_NGROUPS)
829 		free(groups, M_TEMP);
830 	return (error);
831 }
832 
833 int
834 kern_setgroups(struct thread *td, u_int ngrp, gid_t *groups)
835 {
836 	struct proc *p = td->td_proc;
837 	struct ucred *newcred, *oldcred;
838 	int error;
839 
840 	MPASS(ngrp <= ngroups_max + 1);
841 	AUDIT_ARG_GROUPSET(groups, ngrp);
842 	newcred = crget();
843 	crextend(newcred, ngrp);
844 	PROC_LOCK(p);
845 	oldcred = crcopysafe(p, newcred);
846 
847 #ifdef MAC
848 	error = mac_cred_check_setgroups(oldcred, ngrp, groups);
849 	if (error)
850 		goto fail;
851 #endif
852 
853 	error = priv_check_cred(oldcred, PRIV_CRED_SETGROUPS);
854 	if (error)
855 		goto fail;
856 
857 	if (ngrp == 0) {
858 		/*
859 		 * setgroups(0, NULL) is a legitimate way of clearing the
860 		 * groups vector on non-BSD systems (which generally do not
861 		 * have the egid in the groups[0]).  We risk security holes
862 		 * when running non-BSD software if we do not do the same.
863 		 */
864 		newcred->cr_ngroups = 1;
865 	} else {
866 		crsetgroups_locked(newcred, ngrp, groups);
867 	}
868 	setsugid(p);
869 	proc_set_cred(p, newcred);
870 	PROC_UNLOCK(p);
871 	crfree(oldcred);
872 	return (0);
873 
874 fail:
875 	PROC_UNLOCK(p);
876 	crfree(newcred);
877 	return (error);
878 }
879 
880 #ifndef _SYS_SYSPROTO_H_
881 struct setreuid_args {
882 	uid_t	ruid;
883 	uid_t	euid;
884 };
885 #endif
886 /* ARGSUSED */
887 int
888 sys_setreuid(struct thread *td, struct setreuid_args *uap)
889 {
890 	struct proc *p = td->td_proc;
891 	struct ucred *newcred, *oldcred;
892 	uid_t euid, ruid;
893 	struct uidinfo *euip, *ruip;
894 	int error;
895 
896 	euid = uap->euid;
897 	ruid = uap->ruid;
898 	AUDIT_ARG_EUID(euid);
899 	AUDIT_ARG_RUID(ruid);
900 	newcred = crget();
901 	euip = uifind(euid);
902 	ruip = uifind(ruid);
903 	PROC_LOCK(p);
904 	oldcred = crcopysafe(p, newcred);
905 
906 #ifdef MAC
907 	error = mac_cred_check_setreuid(oldcred, ruid, euid);
908 	if (error)
909 		goto fail;
910 #endif
911 
912 	if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid &&
913 	      ruid != oldcred->cr_svuid) ||
914 	     (euid != (uid_t)-1 && euid != oldcred->cr_uid &&
915 	      euid != oldcred->cr_ruid && euid != oldcred->cr_svuid)) &&
916 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETREUID)) != 0)
917 		goto fail;
918 
919 	if (euid != (uid_t)-1 && oldcred->cr_uid != euid) {
920 		change_euid(newcred, euip);
921 		setsugid(p);
922 	}
923 	if (ruid != (uid_t)-1 && oldcred->cr_ruid != ruid) {
924 		change_ruid(newcred, ruip);
925 		setsugid(p);
926 	}
927 	if ((ruid != (uid_t)-1 || newcred->cr_uid != newcred->cr_ruid) &&
928 	    newcred->cr_svuid != newcred->cr_uid) {
929 		change_svuid(newcred, newcred->cr_uid);
930 		setsugid(p);
931 	}
932 	proc_set_cred(p, newcred);
933 #ifdef RACCT
934 	racct_proc_ucred_changed(p, oldcred, newcred);
935 	crhold(newcred);
936 #endif
937 	PROC_UNLOCK(p);
938 #ifdef RCTL
939 	rctl_proc_ucred_changed(p, newcred);
940 	crfree(newcred);
941 #endif
942 	uifree(ruip);
943 	uifree(euip);
944 	crfree(oldcred);
945 	return (0);
946 
947 fail:
948 	PROC_UNLOCK(p);
949 	uifree(ruip);
950 	uifree(euip);
951 	crfree(newcred);
952 	return (error);
953 }
954 
955 #ifndef _SYS_SYSPROTO_H_
956 struct setregid_args {
957 	gid_t	rgid;
958 	gid_t	egid;
959 };
960 #endif
961 /* ARGSUSED */
962 int
963 sys_setregid(struct thread *td, struct setregid_args *uap)
964 {
965 	struct proc *p = td->td_proc;
966 	struct ucred *newcred, *oldcred;
967 	gid_t egid, rgid;
968 	int error;
969 
970 	egid = uap->egid;
971 	rgid = uap->rgid;
972 	AUDIT_ARG_EGID(egid);
973 	AUDIT_ARG_RGID(rgid);
974 	newcred = crget();
975 	PROC_LOCK(p);
976 	oldcred = crcopysafe(p, newcred);
977 
978 #ifdef MAC
979 	error = mac_cred_check_setregid(oldcred, rgid, egid);
980 	if (error)
981 		goto fail;
982 #endif
983 
984 	if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid &&
985 	    rgid != oldcred->cr_svgid) ||
986 	     (egid != (gid_t)-1 && egid != oldcred->cr_groups[0] &&
987 	     egid != oldcred->cr_rgid && egid != oldcred->cr_svgid)) &&
988 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETREGID)) != 0)
989 		goto fail;
990 
991 	if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) {
992 		change_egid(newcred, egid);
993 		setsugid(p);
994 	}
995 	if (rgid != (gid_t)-1 && oldcred->cr_rgid != rgid) {
996 		change_rgid(newcred, rgid);
997 		setsugid(p);
998 	}
999 	if ((rgid != (gid_t)-1 || newcred->cr_groups[0] != newcred->cr_rgid) &&
1000 	    newcred->cr_svgid != newcred->cr_groups[0]) {
1001 		change_svgid(newcred, newcred->cr_groups[0]);
1002 		setsugid(p);
1003 	}
1004 	proc_set_cred(p, newcred);
1005 	PROC_UNLOCK(p);
1006 	crfree(oldcred);
1007 	return (0);
1008 
1009 fail:
1010 	PROC_UNLOCK(p);
1011 	crfree(newcred);
1012 	return (error);
1013 }
1014 
1015 /*
1016  * setresuid(ruid, euid, suid) is like setreuid except control over the saved
1017  * uid is explicit.
1018  */
1019 #ifndef _SYS_SYSPROTO_H_
1020 struct setresuid_args {
1021 	uid_t	ruid;
1022 	uid_t	euid;
1023 	uid_t	suid;
1024 };
1025 #endif
1026 /* ARGSUSED */
1027 int
1028 sys_setresuid(struct thread *td, struct setresuid_args *uap)
1029 {
1030 	struct proc *p = td->td_proc;
1031 	struct ucred *newcred, *oldcred;
1032 	uid_t euid, ruid, suid;
1033 	struct uidinfo *euip, *ruip;
1034 	int error;
1035 
1036 	euid = uap->euid;
1037 	ruid = uap->ruid;
1038 	suid = uap->suid;
1039 	AUDIT_ARG_EUID(euid);
1040 	AUDIT_ARG_RUID(ruid);
1041 	AUDIT_ARG_SUID(suid);
1042 	newcred = crget();
1043 	euip = uifind(euid);
1044 	ruip = uifind(ruid);
1045 	PROC_LOCK(p);
1046 	oldcred = crcopysafe(p, newcred);
1047 
1048 #ifdef MAC
1049 	error = mac_cred_check_setresuid(oldcred, ruid, euid, suid);
1050 	if (error)
1051 		goto fail;
1052 #endif
1053 
1054 	if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid &&
1055 	     ruid != oldcred->cr_svuid &&
1056 	      ruid != oldcred->cr_uid) ||
1057 	     (euid != (uid_t)-1 && euid != oldcred->cr_ruid &&
1058 	    euid != oldcred->cr_svuid &&
1059 	      euid != oldcred->cr_uid) ||
1060 	     (suid != (uid_t)-1 && suid != oldcred->cr_ruid &&
1061 	    suid != oldcred->cr_svuid &&
1062 	      suid != oldcred->cr_uid)) &&
1063 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETRESUID)) != 0)
1064 		goto fail;
1065 
1066 	if (euid != (uid_t)-1 && oldcred->cr_uid != euid) {
1067 		change_euid(newcred, euip);
1068 		setsugid(p);
1069 	}
1070 	if (ruid != (uid_t)-1 && oldcred->cr_ruid != ruid) {
1071 		change_ruid(newcred, ruip);
1072 		setsugid(p);
1073 	}
1074 	if (suid != (uid_t)-1 && oldcred->cr_svuid != suid) {
1075 		change_svuid(newcred, suid);
1076 		setsugid(p);
1077 	}
1078 	proc_set_cred(p, newcred);
1079 #ifdef RACCT
1080 	racct_proc_ucred_changed(p, oldcred, newcred);
1081 	crhold(newcred);
1082 #endif
1083 	PROC_UNLOCK(p);
1084 #ifdef RCTL
1085 	rctl_proc_ucred_changed(p, newcred);
1086 	crfree(newcred);
1087 #endif
1088 	uifree(ruip);
1089 	uifree(euip);
1090 	crfree(oldcred);
1091 	return (0);
1092 
1093 fail:
1094 	PROC_UNLOCK(p);
1095 	uifree(ruip);
1096 	uifree(euip);
1097 	crfree(newcred);
1098 	return (error);
1099 
1100 }
1101 
1102 /*
1103  * setresgid(rgid, egid, sgid) is like setregid except control over the saved
1104  * gid is explicit.
1105  */
1106 #ifndef _SYS_SYSPROTO_H_
1107 struct setresgid_args {
1108 	gid_t	rgid;
1109 	gid_t	egid;
1110 	gid_t	sgid;
1111 };
1112 #endif
1113 /* ARGSUSED */
1114 int
1115 sys_setresgid(struct thread *td, struct setresgid_args *uap)
1116 {
1117 	struct proc *p = td->td_proc;
1118 	struct ucred *newcred, *oldcred;
1119 	gid_t egid, rgid, sgid;
1120 	int error;
1121 
1122 	egid = uap->egid;
1123 	rgid = uap->rgid;
1124 	sgid = uap->sgid;
1125 	AUDIT_ARG_EGID(egid);
1126 	AUDIT_ARG_RGID(rgid);
1127 	AUDIT_ARG_SGID(sgid);
1128 	newcred = crget();
1129 	PROC_LOCK(p);
1130 	oldcred = crcopysafe(p, newcred);
1131 
1132 #ifdef MAC
1133 	error = mac_cred_check_setresgid(oldcred, rgid, egid, sgid);
1134 	if (error)
1135 		goto fail;
1136 #endif
1137 
1138 	if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid &&
1139 	      rgid != oldcred->cr_svgid &&
1140 	      rgid != oldcred->cr_groups[0]) ||
1141 	     (egid != (gid_t)-1 && egid != oldcred->cr_rgid &&
1142 	      egid != oldcred->cr_svgid &&
1143 	      egid != oldcred->cr_groups[0]) ||
1144 	     (sgid != (gid_t)-1 && sgid != oldcred->cr_rgid &&
1145 	      sgid != oldcred->cr_svgid &&
1146 	      sgid != oldcred->cr_groups[0])) &&
1147 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETRESGID)) != 0)
1148 		goto fail;
1149 
1150 	if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) {
1151 		change_egid(newcred, egid);
1152 		setsugid(p);
1153 	}
1154 	if (rgid != (gid_t)-1 && oldcred->cr_rgid != rgid) {
1155 		change_rgid(newcred, rgid);
1156 		setsugid(p);
1157 	}
1158 	if (sgid != (gid_t)-1 && oldcred->cr_svgid != sgid) {
1159 		change_svgid(newcred, sgid);
1160 		setsugid(p);
1161 	}
1162 	proc_set_cred(p, newcred);
1163 	PROC_UNLOCK(p);
1164 	crfree(oldcred);
1165 	return (0);
1166 
1167 fail:
1168 	PROC_UNLOCK(p);
1169 	crfree(newcred);
1170 	return (error);
1171 }
1172 
1173 #ifndef _SYS_SYSPROTO_H_
1174 struct getresuid_args {
1175 	uid_t	*ruid;
1176 	uid_t	*euid;
1177 	uid_t	*suid;
1178 };
1179 #endif
1180 /* ARGSUSED */
1181 int
1182 sys_getresuid(struct thread *td, struct getresuid_args *uap)
1183 {
1184 	struct ucred *cred;
1185 	int error1 = 0, error2 = 0, error3 = 0;
1186 
1187 	cred = td->td_ucred;
1188 	if (uap->ruid)
1189 		error1 = copyout(&cred->cr_ruid,
1190 		    uap->ruid, sizeof(cred->cr_ruid));
1191 	if (uap->euid)
1192 		error2 = copyout(&cred->cr_uid,
1193 		    uap->euid, sizeof(cred->cr_uid));
1194 	if (uap->suid)
1195 		error3 = copyout(&cred->cr_svuid,
1196 		    uap->suid, sizeof(cred->cr_svuid));
1197 	return (error1 ? error1 : error2 ? error2 : error3);
1198 }
1199 
1200 #ifndef _SYS_SYSPROTO_H_
1201 struct getresgid_args {
1202 	gid_t	*rgid;
1203 	gid_t	*egid;
1204 	gid_t	*sgid;
1205 };
1206 #endif
1207 /* ARGSUSED */
1208 int
1209 sys_getresgid(struct thread *td, struct getresgid_args *uap)
1210 {
1211 	struct ucred *cred;
1212 	int error1 = 0, error2 = 0, error3 = 0;
1213 
1214 	cred = td->td_ucred;
1215 	if (uap->rgid)
1216 		error1 = copyout(&cred->cr_rgid,
1217 		    uap->rgid, sizeof(cred->cr_rgid));
1218 	if (uap->egid)
1219 		error2 = copyout(&cred->cr_groups[0],
1220 		    uap->egid, sizeof(cred->cr_groups[0]));
1221 	if (uap->sgid)
1222 		error3 = copyout(&cred->cr_svgid,
1223 		    uap->sgid, sizeof(cred->cr_svgid));
1224 	return (error1 ? error1 : error2 ? error2 : error3);
1225 }
1226 
1227 #ifndef _SYS_SYSPROTO_H_
1228 struct issetugid_args {
1229 	int dummy;
1230 };
1231 #endif
1232 /* ARGSUSED */
1233 int
1234 sys_issetugid(struct thread *td, struct issetugid_args *uap)
1235 {
1236 	struct proc *p = td->td_proc;
1237 
1238 	/*
1239 	 * Note: OpenBSD sets a P_SUGIDEXEC flag set at execve() time,
1240 	 * we use P_SUGID because we consider changing the owners as
1241 	 * "tainting" as well.
1242 	 * This is significant for procs that start as root and "become"
1243 	 * a user without an exec - programs cannot know *everything*
1244 	 * that libc *might* have put in their data segment.
1245 	 */
1246 	td->td_retval[0] = (p->p_flag & P_SUGID) ? 1 : 0;
1247 	return (0);
1248 }
1249 
1250 int
1251 sys___setugid(struct thread *td, struct __setugid_args *uap)
1252 {
1253 #ifdef REGRESSION
1254 	struct proc *p;
1255 
1256 	p = td->td_proc;
1257 	switch (uap->flag) {
1258 	case 0:
1259 		PROC_LOCK(p);
1260 		p->p_flag &= ~P_SUGID;
1261 		PROC_UNLOCK(p);
1262 		return (0);
1263 	case 1:
1264 		PROC_LOCK(p);
1265 		p->p_flag |= P_SUGID;
1266 		PROC_UNLOCK(p);
1267 		return (0);
1268 	default:
1269 		return (EINVAL);
1270 	}
1271 #else /* !REGRESSION */
1272 
1273 	return (ENOSYS);
1274 #endif /* REGRESSION */
1275 }
1276 
1277 /*
1278  * Returns whether gid designates a supplementary group in cred.
1279  */
1280 static bool
1281 supplementary_group_member(gid_t gid, struct ucred *cred)
1282 {
1283 	int l, h, m;
1284 
1285 	/*
1286 	 * Perform a binary search of the supplemental groups.  This is possible
1287 	 * because we sort the groups in crsetgroups().
1288 	 */
1289 	l = 1;
1290 	h = cred->cr_ngroups;
1291 
1292 	while (l < h) {
1293 		m = l + (h - l) / 2;
1294 		if (cred->cr_groups[m] < gid)
1295 			l = m + 1;
1296 		else
1297 			h = m;
1298 	}
1299 
1300 	return (l < cred->cr_ngroups && cred->cr_groups[l] == gid);
1301 }
1302 
1303 /*
1304  * Check if gid is a member of the (effective) group set (i.e., effective and
1305  * supplementary groups).
1306  */
1307 bool
1308 groupmember(gid_t gid, struct ucred *cred)
1309 {
1310 
1311 	if (gid == cred->cr_groups[0])
1312 		return (true);
1313 
1314 	return (supplementary_group_member(gid, cred));
1315 }
1316 
1317 /*
1318  * Check if gid is a member of the real group set (i.e., real and supplementary
1319  * groups).
1320  */
1321 bool
1322 realgroupmember(gid_t gid, struct ucred *cred)
1323 {
1324 	if (gid == cred->cr_rgid)
1325 		return (true);
1326 
1327 	return (supplementary_group_member(gid, cred));
1328 }
1329 
1330 /*
1331  * Test the active securelevel against a given level.  securelevel_gt()
1332  * implements (securelevel > level).  securelevel_ge() implements
1333  * (securelevel >= level).  Note that the logic is inverted -- these
1334  * functions return EPERM on "success" and 0 on "failure".
1335  *
1336  * Due to care taken when setting the securelevel, we know that no jail will
1337  * be less secure that its parent (or the physical system), so it is sufficient
1338  * to test the current jail only.
1339  *
1340  * XXXRW: Possibly since this has to do with privilege, it should move to
1341  * kern_priv.c.
1342  */
1343 int
1344 securelevel_gt(struct ucred *cr, int level)
1345 {
1346 
1347 	return (cr->cr_prison->pr_securelevel > level ? EPERM : 0);
1348 }
1349 
1350 int
1351 securelevel_ge(struct ucred *cr, int level)
1352 {
1353 
1354 	return (cr->cr_prison->pr_securelevel >= level ? EPERM : 0);
1355 }
1356 
1357 /*
1358  * 'see_other_uids' determines whether or not visibility of processes
1359  * and sockets with credentials holding different real uids is possible
1360  * using a variety of system MIBs.
1361  * XXX: data declarations should be together near the beginning of the file.
1362  */
1363 static int	see_other_uids = 1;
1364 SYSCTL_INT(_security_bsd, OID_AUTO, see_other_uids, CTLFLAG_RW,
1365     &see_other_uids, 0,
1366     "Unprivileged processes may see subjects/objects with different real uid");
1367 
1368 /*-
1369  * Determine if u1 "can see" the subject specified by u2, according to the
1370  * 'see_other_uids' policy.
1371  * Returns: 0 for permitted, ESRCH otherwise
1372  * Locks: none
1373  * References: *u1 and *u2 must not change during the call
1374  *             u1 may equal u2, in which case only one reference is required
1375  */
1376 static int
1377 cr_canseeotheruids(struct ucred *u1, struct ucred *u2)
1378 {
1379 
1380 	if (!see_other_uids && u1->cr_ruid != u2->cr_ruid) {
1381 		if (priv_check_cred(u1, PRIV_SEEOTHERUIDS) != 0)
1382 			return (ESRCH);
1383 	}
1384 	return (0);
1385 }
1386 
1387 /*
1388  * 'see_other_gids' determines whether or not visibility of processes
1389  * and sockets with credentials holding different real gids is possible
1390  * using a variety of system MIBs.
1391  * XXX: data declarations should be together near the beginning of the file.
1392  */
1393 static int	see_other_gids = 1;
1394 SYSCTL_INT(_security_bsd, OID_AUTO, see_other_gids, CTLFLAG_RW,
1395     &see_other_gids, 0,
1396     "Unprivileged processes may see subjects/objects with different real gid");
1397 
1398 /*
1399  * Determine if u1 can "see" the subject specified by u2, according to the
1400  * 'see_other_gids' policy.
1401  * Returns: 0 for permitted, ESRCH otherwise
1402  * Locks: none
1403  * References: *u1 and *u2 must not change during the call
1404  *             u1 may equal u2, in which case only one reference is required
1405  */
1406 static int
1407 cr_canseeothergids(struct ucred *u1, struct ucred *u2)
1408 {
1409 	if (!see_other_gids) {
1410 		if (realgroupmember(u1->cr_rgid, u2))
1411 			return (0);
1412 
1413 		for (int i = 1; i < u1->cr_ngroups; i++)
1414 			if (realgroupmember(u1->cr_groups[i], u2))
1415 				return (0);
1416 
1417 		if (priv_check_cred(u1, PRIV_SEEOTHERGIDS) != 0)
1418 			return (ESRCH);
1419 	}
1420 
1421 	return (0);
1422 }
1423 
1424 /*
1425  * 'see_jail_proc' determines whether or not visibility of processes and
1426  * sockets with credentials holding different jail ids is possible using a
1427  * variety of system MIBs.
1428  *
1429  * XXX: data declarations should be together near the beginning of the file.
1430  */
1431 
1432 static int	see_jail_proc = 1;
1433 SYSCTL_INT(_security_bsd, OID_AUTO, see_jail_proc, CTLFLAG_RW,
1434     &see_jail_proc, 0,
1435     "Unprivileged processes may see subjects/objects with different jail ids");
1436 
1437 /*-
1438  * Determine if u1 "can see" the subject specified by u2, according to the
1439  * 'see_jail_proc' policy.
1440  * Returns: 0 for permitted, ESRCH otherwise
1441  * Locks: none
1442  * References: *u1 and *u2 must not change during the call
1443  *             u1 may equal u2, in which case only one reference is required
1444  */
1445 static int
1446 cr_canseejailproc(struct ucred *u1, struct ucred *u2)
1447 {
1448 	if (see_jail_proc || /* Policy deactivated. */
1449 	    u1->cr_prison == u2->cr_prison || /* Same jail. */
1450 	    priv_check_cred(u1, PRIV_SEEJAILPROC) == 0) /* Privileged. */
1451 		return (0);
1452 
1453 	return (ESRCH);
1454 }
1455 
1456 /*
1457  * Helper for cr_cansee*() functions to abide by system-wide security.bsd.see_*
1458  * policies.  Determines if u1 "can see" u2 according to these policies.
1459  * Returns: 0 for permitted, ESRCH otherwise
1460  */
1461 int
1462 cr_bsd_visible(struct ucred *u1, struct ucred *u2)
1463 {
1464 	int error;
1465 
1466 	if ((error = cr_canseeotheruids(u1, u2)))
1467 		return (error);
1468 	if ((error = cr_canseeothergids(u1, u2)))
1469 		return (error);
1470 	if ((error = cr_canseejailproc(u1, u2)))
1471 		return (error);
1472 	return (0);
1473 }
1474 
1475 /*-
1476  * Determine if u1 "can see" the subject specified by u2.
1477  * Returns: 0 for permitted, an errno value otherwise
1478  * Locks: none
1479  * References: *u1 and *u2 must not change during the call
1480  *             u1 may equal u2, in which case only one reference is required
1481  */
1482 int
1483 cr_cansee(struct ucred *u1, struct ucred *u2)
1484 {
1485 	int error;
1486 
1487 	if ((error = prison_check(u1, u2)))
1488 		return (error);
1489 #ifdef MAC
1490 	if ((error = mac_cred_check_visible(u1, u2)))
1491 		return (error);
1492 #endif
1493 	if ((error = cr_bsd_visible(u1, u2)))
1494 		return (error);
1495 	return (0);
1496 }
1497 
1498 /*-
1499  * Determine if td "can see" the subject specified by p.
1500  * Returns: 0 for permitted, an errno value otherwise
1501  * Locks: Sufficient locks to protect p->p_ucred must be held.  td really
1502  *        should be curthread.
1503  * References: td and p must be valid for the lifetime of the call
1504  */
1505 int
1506 p_cansee(struct thread *td, struct proc *p)
1507 {
1508 	/* Wrap cr_cansee() for all functionality. */
1509 	KASSERT(td == curthread, ("%s: td not curthread", __func__));
1510 	PROC_LOCK_ASSERT(p, MA_OWNED);
1511 
1512 	if (td->td_proc == p)
1513 		return (0);
1514 	return (cr_cansee(td->td_ucred, p->p_ucred));
1515 }
1516 
1517 /*
1518  * 'conservative_signals' prevents the delivery of a broad class of
1519  * signals by unprivileged processes to processes that have changed their
1520  * credentials since the last invocation of execve().  This can prevent
1521  * the leakage of cached information or retained privileges as a result
1522  * of a common class of signal-related vulnerabilities.  However, this
1523  * may interfere with some applications that expect to be able to
1524  * deliver these signals to peer processes after having given up
1525  * privilege.
1526  */
1527 static int	conservative_signals = 1;
1528 SYSCTL_INT(_security_bsd, OID_AUTO, conservative_signals, CTLFLAG_RW,
1529     &conservative_signals, 0, "Unprivileged processes prevented from "
1530     "sending certain signals to processes whose credentials have changed");
1531 /*-
1532  * Determine whether cred may deliver the specified signal to proc.
1533  * Returns: 0 for permitted, an errno value otherwise.
1534  * Locks: A lock must be held for proc.
1535  * References: cred and proc must be valid for the lifetime of the call.
1536  */
1537 int
1538 cr_cansignal(struct ucred *cred, struct proc *proc, int signum)
1539 {
1540 	int error;
1541 
1542 	PROC_LOCK_ASSERT(proc, MA_OWNED);
1543 	/*
1544 	 * Jail semantics limit the scope of signalling to proc in the
1545 	 * same jail as cred, if cred is in jail.
1546 	 */
1547 	error = prison_check(cred, proc->p_ucred);
1548 	if (error)
1549 		return (error);
1550 #ifdef MAC
1551 	if ((error = mac_proc_check_signal(cred, proc, signum)))
1552 		return (error);
1553 #endif
1554 	if ((error = cr_bsd_visible(cred, proc->p_ucred)))
1555 		return (error);
1556 
1557 	/*
1558 	 * UNIX signal semantics depend on the status of the P_SUGID
1559 	 * bit on the target process.  If the bit is set, then additional
1560 	 * restrictions are placed on the set of available signals.
1561 	 */
1562 	if (conservative_signals && (proc->p_flag & P_SUGID)) {
1563 		switch (signum) {
1564 		case 0:
1565 		case SIGKILL:
1566 		case SIGINT:
1567 		case SIGTERM:
1568 		case SIGALRM:
1569 		case SIGSTOP:
1570 		case SIGTTIN:
1571 		case SIGTTOU:
1572 		case SIGTSTP:
1573 		case SIGHUP:
1574 		case SIGUSR1:
1575 		case SIGUSR2:
1576 			/*
1577 			 * Generally, permit job and terminal control
1578 			 * signals.
1579 			 */
1580 			break;
1581 		default:
1582 			/* Not permitted without privilege. */
1583 			error = priv_check_cred(cred, PRIV_SIGNAL_SUGID);
1584 			if (error)
1585 				return (error);
1586 		}
1587 	}
1588 
1589 	/*
1590 	 * Generally, the target credential's ruid or svuid must match the
1591 	 * subject credential's ruid or euid.
1592 	 */
1593 	if (cred->cr_ruid != proc->p_ucred->cr_ruid &&
1594 	    cred->cr_ruid != proc->p_ucred->cr_svuid &&
1595 	    cred->cr_uid != proc->p_ucred->cr_ruid &&
1596 	    cred->cr_uid != proc->p_ucred->cr_svuid) {
1597 		error = priv_check_cred(cred, PRIV_SIGNAL_DIFFCRED);
1598 		if (error)
1599 			return (error);
1600 	}
1601 
1602 	return (0);
1603 }
1604 
1605 /*-
1606  * Determine whether td may deliver the specified signal to p.
1607  * Returns: 0 for permitted, an errno value otherwise
1608  * Locks: Sufficient locks to protect various components of td and p
1609  *        must be held.  td must be curthread, and a lock must be
1610  *        held for p.
1611  * References: td and p must be valid for the lifetime of the call
1612  */
1613 int
1614 p_cansignal(struct thread *td, struct proc *p, int signum)
1615 {
1616 
1617 	KASSERT(td == curthread, ("%s: td not curthread", __func__));
1618 	PROC_LOCK_ASSERT(p, MA_OWNED);
1619 	if (td->td_proc == p)
1620 		return (0);
1621 
1622 	/*
1623 	 * UNIX signalling semantics require that processes in the same
1624 	 * session always be able to deliver SIGCONT to one another,
1625 	 * overriding the remaining protections.
1626 	 */
1627 	/* XXX: This will require an additional lock of some sort. */
1628 	if (signum == SIGCONT && td->td_proc->p_session == p->p_session)
1629 		return (0);
1630 	/*
1631 	 * Some compat layers use SIGTHR and higher signals for
1632 	 * communication between different kernel threads of the same
1633 	 * process, so that they expect that it's always possible to
1634 	 * deliver them, even for suid applications where cr_cansignal() can
1635 	 * deny such ability for security consideration.  It should be
1636 	 * pretty safe to do since the only way to create two processes
1637 	 * with the same p_leader is via rfork(2).
1638 	 */
1639 	if (td->td_proc->p_leader != NULL && signum >= SIGTHR &&
1640 	    signum < SIGTHR + 4 && td->td_proc->p_leader == p->p_leader)
1641 		return (0);
1642 
1643 	return (cr_cansignal(td->td_ucred, p, signum));
1644 }
1645 
1646 /*-
1647  * Determine whether td may reschedule p.
1648  * Returns: 0 for permitted, an errno value otherwise
1649  * Locks: Sufficient locks to protect various components of td and p
1650  *        must be held.  td must be curthread, and a lock must
1651  *        be held for p.
1652  * References: td and p must be valid for the lifetime of the call
1653  */
1654 int
1655 p_cansched(struct thread *td, struct proc *p)
1656 {
1657 	int error;
1658 
1659 	KASSERT(td == curthread, ("%s: td not curthread", __func__));
1660 	PROC_LOCK_ASSERT(p, MA_OWNED);
1661 	if (td->td_proc == p)
1662 		return (0);
1663 	if ((error = prison_check(td->td_ucred, p->p_ucred)))
1664 		return (error);
1665 #ifdef MAC
1666 	if ((error = mac_proc_check_sched(td->td_ucred, p)))
1667 		return (error);
1668 #endif
1669 	if ((error = cr_bsd_visible(td->td_ucred, p->p_ucred)))
1670 		return (error);
1671 
1672 	if (td->td_ucred->cr_ruid != p->p_ucred->cr_ruid &&
1673 	    td->td_ucred->cr_uid != p->p_ucred->cr_ruid) {
1674 		error = priv_check(td, PRIV_SCHED_DIFFCRED);
1675 		if (error)
1676 			return (error);
1677 	}
1678 	return (0);
1679 }
1680 
1681 /*
1682  * Handle getting or setting the prison's unprivileged_proc_debug
1683  * value.
1684  */
1685 static int
1686 sysctl_unprivileged_proc_debug(SYSCTL_HANDLER_ARGS)
1687 {
1688 	int error, val;
1689 
1690 	val = prison_allow(req->td->td_ucred, PR_ALLOW_UNPRIV_DEBUG);
1691 	error = sysctl_handle_int(oidp, &val, 0, req);
1692 	if (error != 0 || req->newptr == NULL)
1693 		return (error);
1694 	if (val != 0 && val != 1)
1695 		return (EINVAL);
1696 	prison_set_allow(req->td->td_ucred, PR_ALLOW_UNPRIV_DEBUG, val);
1697 	return (0);
1698 }
1699 
1700 /*
1701  * The 'unprivileged_proc_debug' flag may be used to disable a variety of
1702  * unprivileged inter-process debugging services, including some procfs
1703  * functionality, ptrace(), and ktrace().  In the past, inter-process
1704  * debugging has been involved in a variety of security problems, and sites
1705  * not requiring the service might choose to disable it when hardening
1706  * systems.
1707  */
1708 SYSCTL_PROC(_security_bsd, OID_AUTO, unprivileged_proc_debug,
1709     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_PRISON | CTLFLAG_SECURE |
1710     CTLFLAG_MPSAFE, 0, 0, sysctl_unprivileged_proc_debug, "I",
1711     "Unprivileged processes may use process debugging facilities");
1712 
1713 /*-
1714  * Determine whether td may debug p.
1715  * Returns: 0 for permitted, an errno value otherwise
1716  * Locks: Sufficient locks to protect various components of td and p
1717  *        must be held.  td must be curthread, and a lock must
1718  *        be held for p.
1719  * References: td and p must be valid for the lifetime of the call
1720  */
1721 int
1722 p_candebug(struct thread *td, struct proc *p)
1723 {
1724 	int error, grpsubset, i, uidsubset;
1725 
1726 	KASSERT(td == curthread, ("%s: td not curthread", __func__));
1727 	PROC_LOCK_ASSERT(p, MA_OWNED);
1728 	if (td->td_proc == p)
1729 		return (0);
1730 	if ((error = priv_check(td, PRIV_DEBUG_UNPRIV)))
1731 		return (error);
1732 	if ((error = prison_check(td->td_ucred, p->p_ucred)))
1733 		return (error);
1734 #ifdef MAC
1735 	if ((error = mac_proc_check_debug(td->td_ucred, p)))
1736 		return (error);
1737 #endif
1738 	if ((error = cr_bsd_visible(td->td_ucred, p->p_ucred)))
1739 		return (error);
1740 
1741 	/*
1742 	 * Is p's group set a subset of td's effective group set?  This
1743 	 * includes p's egid, group access list, rgid, and svgid.
1744 	 */
1745 	grpsubset = 1;
1746 	for (i = 0; i < p->p_ucred->cr_ngroups; i++) {
1747 		if (!groupmember(p->p_ucred->cr_groups[i], td->td_ucred)) {
1748 			grpsubset = 0;
1749 			break;
1750 		}
1751 	}
1752 	grpsubset = grpsubset &&
1753 	    groupmember(p->p_ucred->cr_rgid, td->td_ucred) &&
1754 	    groupmember(p->p_ucred->cr_svgid, td->td_ucred);
1755 
1756 	/*
1757 	 * Are the uids present in p's credential equal to td's
1758 	 * effective uid?  This includes p's euid, svuid, and ruid.
1759 	 */
1760 	uidsubset = (td->td_ucred->cr_uid == p->p_ucred->cr_uid &&
1761 	    td->td_ucred->cr_uid == p->p_ucred->cr_svuid &&
1762 	    td->td_ucred->cr_uid == p->p_ucred->cr_ruid);
1763 
1764 	/*
1765 	 * If p's gids aren't a subset, or the uids aren't a subset,
1766 	 * or the credential has changed, require appropriate privilege
1767 	 * for td to debug p.
1768 	 */
1769 	if (!grpsubset || !uidsubset) {
1770 		error = priv_check(td, PRIV_DEBUG_DIFFCRED);
1771 		if (error)
1772 			return (error);
1773 	}
1774 
1775 	/*
1776 	 * Has the credential of the process changed since the last exec()?
1777 	 */
1778 	if ((p->p_flag & P_SUGID) != 0) {
1779 		error = priv_check(td, PRIV_DEBUG_SUGID);
1780 		if (error)
1781 			return (error);
1782 	}
1783 
1784 	/* Can't trace init when securelevel > 0. */
1785 	if (p == initproc) {
1786 		error = securelevel_gt(td->td_ucred, 0);
1787 		if (error)
1788 			return (error);
1789 	}
1790 
1791 	/*
1792 	 * Can't trace a process that's currently exec'ing.
1793 	 *
1794 	 * XXX: Note, this is not a security policy decision, it's a
1795 	 * basic correctness/functionality decision.  Therefore, this check
1796 	 * should be moved to the caller's of p_candebug().
1797 	 */
1798 	if ((p->p_flag & P_INEXEC) != 0)
1799 		return (EBUSY);
1800 
1801 	/* Denied explicitly */
1802 	if ((p->p_flag2 & P2_NOTRACE) != 0) {
1803 		error = priv_check(td, PRIV_DEBUG_DENIED);
1804 		if (error != 0)
1805 			return (error);
1806 	}
1807 
1808 	return (0);
1809 }
1810 
1811 /*-
1812  * Determine whether the subject represented by cred can "see" a socket.
1813  * Returns: 0 for permitted, ENOENT otherwise.
1814  */
1815 int
1816 cr_canseesocket(struct ucred *cred, struct socket *so)
1817 {
1818 	int error;
1819 
1820 	error = prison_check(cred, so->so_cred);
1821 	if (error)
1822 		return (ENOENT);
1823 #ifdef MAC
1824 	error = mac_socket_check_visible(cred, so);
1825 	if (error)
1826 		return (error);
1827 #endif
1828 	if (cr_bsd_visible(cred, so->so_cred))
1829 		return (ENOENT);
1830 
1831 	return (0);
1832 }
1833 
1834 /*-
1835  * Determine whether td can wait for the exit of p.
1836  * Returns: 0 for permitted, an errno value otherwise
1837  * Locks: Sufficient locks to protect various components of td and p
1838  *        must be held.  td must be curthread, and a lock must
1839  *        be held for p.
1840  * References: td and p must be valid for the lifetime of the call
1841 
1842  */
1843 int
1844 p_canwait(struct thread *td, struct proc *p)
1845 {
1846 	int error;
1847 
1848 	KASSERT(td == curthread, ("%s: td not curthread", __func__));
1849 	PROC_LOCK_ASSERT(p, MA_OWNED);
1850 	if ((error = prison_check(td->td_ucred, p->p_ucred)))
1851 		return (error);
1852 #ifdef MAC
1853 	if ((error = mac_proc_check_wait(td->td_ucred, p)))
1854 		return (error);
1855 #endif
1856 #if 0
1857 	/* XXXMAC: This could have odd effects on some shells. */
1858 	if ((error = cr_bsd_visible(td->td_ucred, p->p_ucred)))
1859 		return (error);
1860 #endif
1861 
1862 	return (0);
1863 }
1864 
1865 /*
1866  * Credential management.
1867  *
1868  * struct ucred objects are rarely allocated but gain and lose references all
1869  * the time (e.g., on struct file alloc/dealloc) turning refcount updates into
1870  * a significant source of cache-line ping ponging. Common cases are worked
1871  * around by modifying thread-local counter instead if the cred to operate on
1872  * matches td_realucred.
1873  *
1874  * The counter is split into 2 parts:
1875  * - cr_users -- total count of all struct proc and struct thread objects
1876  *   which have given cred in p_ucred and td_ucred respectively
1877  * - cr_ref -- the actual ref count, only valid if cr_users == 0
1878  *
1879  * If users == 0 then cr_ref behaves similarly to refcount(9), in particular if
1880  * the count reaches 0 the object is freeable.
1881  * If users > 0 and curthread->td_realucred == cred, then updates are performed
1882  * against td_ucredref.
1883  * In other cases updates are performed against cr_ref.
1884  *
1885  * Changing td_realucred into something else decrements cr_users and transfers
1886  * accumulated updates.
1887  */
1888 struct ucred *
1889 crcowget(struct ucred *cr)
1890 {
1891 
1892 	mtx_lock(&cr->cr_mtx);
1893 	KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
1894 	    __func__, cr->cr_users, cr));
1895 	cr->cr_users++;
1896 	cr->cr_ref++;
1897 	mtx_unlock(&cr->cr_mtx);
1898 	return (cr);
1899 }
1900 
1901 static struct ucred *
1902 crunuse(struct thread *td)
1903 {
1904 	struct ucred *cr, *crold;
1905 
1906 	MPASS(td->td_realucred == td->td_ucred);
1907 	cr = td->td_realucred;
1908 	mtx_lock(&cr->cr_mtx);
1909 	cr->cr_ref += td->td_ucredref;
1910 	td->td_ucredref = 0;
1911 	KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
1912 	    __func__, cr->cr_users, cr));
1913 	cr->cr_users--;
1914 	if (cr->cr_users == 0) {
1915 		KASSERT(cr->cr_ref > 0, ("%s: ref %ld not > 0 on cred %p",
1916 		    __func__, cr->cr_ref, cr));
1917 		crold = cr;
1918 	} else {
1919 		cr->cr_ref--;
1920 		crold = NULL;
1921 	}
1922 	mtx_unlock(&cr->cr_mtx);
1923 	td->td_realucred = NULL;
1924 	return (crold);
1925 }
1926 
1927 static void
1928 crunusebatch(struct ucred *cr, int users, int ref)
1929 {
1930 
1931 	KASSERT(users > 0, ("%s: passed users %d not > 0 ; cred %p",
1932 	    __func__, users, cr));
1933 	mtx_lock(&cr->cr_mtx);
1934 	KASSERT(cr->cr_users >= users, ("%s: users %d not > %d on cred %p",
1935 	    __func__, cr->cr_users, users, cr));
1936 	cr->cr_users -= users;
1937 	cr->cr_ref += ref;
1938 	cr->cr_ref -= users;
1939 	if (cr->cr_users > 0) {
1940 		mtx_unlock(&cr->cr_mtx);
1941 		return;
1942 	}
1943 	KASSERT(cr->cr_ref >= 0, ("%s: ref %ld not >= 0 on cred %p",
1944 	    __func__, cr->cr_ref, cr));
1945 	if (cr->cr_ref > 0) {
1946 		mtx_unlock(&cr->cr_mtx);
1947 		return;
1948 	}
1949 	crfree_final(cr);
1950 }
1951 
1952 void
1953 crcowfree(struct thread *td)
1954 {
1955 	struct ucred *cr;
1956 
1957 	cr = crunuse(td);
1958 	if (cr != NULL)
1959 		crfree(cr);
1960 }
1961 
1962 struct ucred *
1963 crcowsync(void)
1964 {
1965 	struct thread *td;
1966 	struct proc *p;
1967 	struct ucred *crnew, *crold;
1968 
1969 	td = curthread;
1970 	p = td->td_proc;
1971 	PROC_LOCK_ASSERT(p, MA_OWNED);
1972 
1973 	MPASS(td->td_realucred == td->td_ucred);
1974 	if (td->td_realucred == p->p_ucred)
1975 		return (NULL);
1976 
1977 	crnew = crcowget(p->p_ucred);
1978 	crold = crunuse(td);
1979 	td->td_realucred = crnew;
1980 	td->td_ucred = td->td_realucred;
1981 	return (crold);
1982 }
1983 
1984 /*
1985  * Batching.
1986  */
1987 void
1988 credbatch_add(struct credbatch *crb, struct thread *td)
1989 {
1990 	struct ucred *cr;
1991 
1992 	MPASS(td->td_realucred != NULL);
1993 	MPASS(td->td_realucred == td->td_ucred);
1994 	MPASS(TD_GET_STATE(td) == TDS_INACTIVE);
1995 	cr = td->td_realucred;
1996 	KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
1997 	    __func__, cr->cr_users, cr));
1998 	if (crb->cred != cr) {
1999 		if (crb->users > 0) {
2000 			MPASS(crb->cred != NULL);
2001 			crunusebatch(crb->cred, crb->users, crb->ref);
2002 			crb->users = 0;
2003 			crb->ref = 0;
2004 		}
2005 	}
2006 	crb->cred = cr;
2007 	crb->users++;
2008 	crb->ref += td->td_ucredref;
2009 	td->td_ucredref = 0;
2010 	td->td_realucred = NULL;
2011 }
2012 
2013 void
2014 credbatch_final(struct credbatch *crb)
2015 {
2016 
2017 	MPASS(crb->cred != NULL);
2018 	MPASS(crb->users > 0);
2019 	crunusebatch(crb->cred, crb->users, crb->ref);
2020 }
2021 
2022 /*
2023  * Allocate a zeroed cred structure.
2024  */
2025 struct ucred *
2026 crget(void)
2027 {
2028 	struct ucred *cr;
2029 
2030 	cr = malloc(sizeof(*cr), M_CRED, M_WAITOK | M_ZERO);
2031 	mtx_init(&cr->cr_mtx, "cred", NULL, MTX_DEF);
2032 	cr->cr_ref = 1;
2033 #ifdef AUDIT
2034 	audit_cred_init(cr);
2035 #endif
2036 #ifdef MAC
2037 	mac_cred_init(cr);
2038 #endif
2039 	cr->cr_groups = cr->cr_smallgroups;
2040 	cr->cr_agroups =
2041 	    sizeof(cr->cr_smallgroups) / sizeof(cr->cr_smallgroups[0]);
2042 	return (cr);
2043 }
2044 
2045 /*
2046  * Claim another reference to a ucred structure.
2047  */
2048 struct ucred *
2049 crhold(struct ucred *cr)
2050 {
2051 	struct thread *td;
2052 
2053 	td = curthread;
2054 	if (__predict_true(td->td_realucred == cr)) {
2055 		KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
2056 		    __func__, cr->cr_users, cr));
2057 		td->td_ucredref++;
2058 		return (cr);
2059 	}
2060 	mtx_lock(&cr->cr_mtx);
2061 	cr->cr_ref++;
2062 	mtx_unlock(&cr->cr_mtx);
2063 	return (cr);
2064 }
2065 
2066 /*
2067  * Free a cred structure.  Throws away space when ref count gets to 0.
2068  */
2069 void
2070 crfree(struct ucred *cr)
2071 {
2072 	struct thread *td;
2073 
2074 	td = curthread;
2075 	if (__predict_true(td->td_realucred == cr)) {
2076 		KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
2077 		    __func__, cr->cr_users, cr));
2078 		td->td_ucredref--;
2079 		return;
2080 	}
2081 	mtx_lock(&cr->cr_mtx);
2082 	KASSERT(cr->cr_users >= 0, ("%s: users %d not >= 0 on cred %p",
2083 	    __func__, cr->cr_users, cr));
2084 	cr->cr_ref--;
2085 	if (cr->cr_users > 0) {
2086 		mtx_unlock(&cr->cr_mtx);
2087 		return;
2088 	}
2089 	KASSERT(cr->cr_ref >= 0, ("%s: ref %ld not >= 0 on cred %p",
2090 	    __func__, cr->cr_ref, cr));
2091 	if (cr->cr_ref > 0) {
2092 		mtx_unlock(&cr->cr_mtx);
2093 		return;
2094 	}
2095 	crfree_final(cr);
2096 }
2097 
2098 static void
2099 crfree_final(struct ucred *cr)
2100 {
2101 
2102 	KASSERT(cr->cr_users == 0, ("%s: users %d not == 0 on cred %p",
2103 	    __func__, cr->cr_users, cr));
2104 	KASSERT(cr->cr_ref == 0, ("%s: ref %ld not == 0 on cred %p",
2105 	    __func__, cr->cr_ref, cr));
2106 
2107 	/*
2108 	 * Some callers of crget(), such as nfs_statfs(), allocate a temporary
2109 	 * credential, but don't allocate a uidinfo structure.
2110 	 */
2111 	if (cr->cr_uidinfo != NULL)
2112 		uifree(cr->cr_uidinfo);
2113 	if (cr->cr_ruidinfo != NULL)
2114 		uifree(cr->cr_ruidinfo);
2115 	if (cr->cr_prison != NULL)
2116 		prison_free(cr->cr_prison);
2117 	if (cr->cr_loginclass != NULL)
2118 		loginclass_free(cr->cr_loginclass);
2119 #ifdef AUDIT
2120 	audit_cred_destroy(cr);
2121 #endif
2122 #ifdef MAC
2123 	mac_cred_destroy(cr);
2124 #endif
2125 	mtx_destroy(&cr->cr_mtx);
2126 	if (cr->cr_groups != cr->cr_smallgroups)
2127 		free(cr->cr_groups, M_CRED);
2128 	free(cr, M_CRED);
2129 }
2130 
2131 /*
2132  * Copy a ucred's contents from a template.  Does not block.
2133  */
2134 void
2135 crcopy(struct ucred *dest, struct ucred *src)
2136 {
2137 
2138 	KASSERT(dest->cr_ref == 1, ("crcopy of shared ucred"));
2139 	bcopy(&src->cr_startcopy, &dest->cr_startcopy,
2140 	    (unsigned)((caddr_t)&src->cr_endcopy -
2141 		(caddr_t)&src->cr_startcopy));
2142 	dest->cr_flags = src->cr_flags;
2143 	crsetgroups(dest, src->cr_ngroups, src->cr_groups);
2144 	uihold(dest->cr_uidinfo);
2145 	uihold(dest->cr_ruidinfo);
2146 	prison_hold(dest->cr_prison);
2147 	loginclass_hold(dest->cr_loginclass);
2148 #ifdef AUDIT
2149 	audit_cred_copy(src, dest);
2150 #endif
2151 #ifdef MAC
2152 	mac_cred_copy(src, dest);
2153 #endif
2154 }
2155 
2156 /*
2157  * Dup cred struct to a new held one.
2158  */
2159 struct ucred *
2160 crdup(struct ucred *cr)
2161 {
2162 	struct ucred *newcr;
2163 
2164 	newcr = crget();
2165 	crcopy(newcr, cr);
2166 	return (newcr);
2167 }
2168 
2169 /*
2170  * Fill in a struct xucred based on a struct ucred.
2171  */
2172 void
2173 cru2x(struct ucred *cr, struct xucred *xcr)
2174 {
2175 	int ngroups;
2176 
2177 	bzero(xcr, sizeof(*xcr));
2178 	xcr->cr_version = XUCRED_VERSION;
2179 	xcr->cr_uid = cr->cr_uid;
2180 
2181 	ngroups = MIN(cr->cr_ngroups, XU_NGROUPS);
2182 	xcr->cr_ngroups = ngroups;
2183 	bcopy(cr->cr_groups, xcr->cr_groups,
2184 	    ngroups * sizeof(*cr->cr_groups));
2185 }
2186 
2187 void
2188 cru2xt(struct thread *td, struct xucred *xcr)
2189 {
2190 
2191 	cru2x(td->td_ucred, xcr);
2192 	xcr->cr_pid = td->td_proc->p_pid;
2193 }
2194 
2195 /*
2196  * Change process credentials.
2197  * Callers are responsible for providing the reference for passed credentials
2198  * and for freeing old ones.
2199  *
2200  * Process has to be locked except when it does not have credentials (as it
2201  * should not be visible just yet) or when newcred is NULL (as this can be
2202  * only used when the process is about to be freed, at which point it should
2203  * not be visible anymore).
2204  */
2205 void
2206 proc_set_cred(struct proc *p, struct ucred *newcred)
2207 {
2208 	struct ucred *cr;
2209 
2210 	cr = p->p_ucred;
2211 	MPASS(cr != NULL);
2212 	PROC_LOCK_ASSERT(p, MA_OWNED);
2213 	KASSERT(newcred->cr_users == 0, ("%s: users %d not 0 on cred %p",
2214 	    __func__, newcred->cr_users, newcred));
2215 	mtx_lock(&cr->cr_mtx);
2216 	KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
2217 	    __func__, cr->cr_users, cr));
2218 	cr->cr_users--;
2219 	mtx_unlock(&cr->cr_mtx);
2220 	p->p_ucred = newcred;
2221 	newcred->cr_users = 1;
2222 	PROC_UPDATE_COW(p);
2223 }
2224 
2225 void
2226 proc_unset_cred(struct proc *p)
2227 {
2228 	struct ucred *cr;
2229 
2230 	MPASS(p->p_state == PRS_ZOMBIE || p->p_state == PRS_NEW);
2231 	cr = p->p_ucred;
2232 	p->p_ucred = NULL;
2233 	KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
2234 	    __func__, cr->cr_users, cr));
2235 	mtx_lock(&cr->cr_mtx);
2236 	cr->cr_users--;
2237 	if (cr->cr_users == 0)
2238 		KASSERT(cr->cr_ref > 0, ("%s: ref %ld not > 0 on cred %p",
2239 		    __func__, cr->cr_ref, cr));
2240 	mtx_unlock(&cr->cr_mtx);
2241 	crfree(cr);
2242 }
2243 
2244 struct ucred *
2245 crcopysafe(struct proc *p, struct ucred *cr)
2246 {
2247 	struct ucred *oldcred;
2248 	int groups;
2249 
2250 	PROC_LOCK_ASSERT(p, MA_OWNED);
2251 
2252 	oldcred = p->p_ucred;
2253 	while (cr->cr_agroups < oldcred->cr_agroups) {
2254 		groups = oldcred->cr_agroups;
2255 		PROC_UNLOCK(p);
2256 		crextend(cr, groups);
2257 		PROC_LOCK(p);
2258 		oldcred = p->p_ucred;
2259 	}
2260 	crcopy(cr, oldcred);
2261 
2262 	return (oldcred);
2263 }
2264 
2265 /*
2266  * Extend the passed in credential to hold n items.
2267  */
2268 void
2269 crextend(struct ucred *cr, int n)
2270 {
2271 	int cnt;
2272 
2273 	/* Truncate? */
2274 	if (n <= cr->cr_agroups)
2275 		return;
2276 
2277 	/*
2278 	 * We extend by 2 each time since we're using a power of two
2279 	 * allocator until we need enough groups to fill a page.
2280 	 * Once we're allocating multiple pages, only allocate as many
2281 	 * as we actually need.  The case of processes needing a
2282 	 * non-power of two number of pages seems more likely than
2283 	 * a real world process that adds thousands of groups one at a
2284 	 * time.
2285 	 */
2286 	if ( n < PAGE_SIZE / sizeof(gid_t) ) {
2287 		if (cr->cr_agroups == 0)
2288 			cnt = MAX(1, MINALLOCSIZE / sizeof(gid_t));
2289 		else
2290 			cnt = cr->cr_agroups * 2;
2291 
2292 		while (cnt < n)
2293 			cnt *= 2;
2294 	} else
2295 		cnt = roundup2(n, PAGE_SIZE / sizeof(gid_t));
2296 
2297 	/* Free the old array. */
2298 	if (cr->cr_groups != cr->cr_smallgroups)
2299 		free(cr->cr_groups, M_CRED);
2300 
2301 	cr->cr_groups = malloc(cnt * sizeof(gid_t), M_CRED, M_WAITOK | M_ZERO);
2302 	cr->cr_agroups = cnt;
2303 }
2304 
2305 /*
2306  * Copy groups in to a credential, preserving any necessary invariants.
2307  * Currently this includes the sorting of all supplemental gids.
2308  * crextend() must have been called before hand to ensure sufficient
2309  * space is available.
2310  */
2311 static void
2312 crsetgroups_locked(struct ucred *cr, int ngrp, gid_t *groups)
2313 {
2314 	int i;
2315 	int j;
2316 	gid_t g;
2317 
2318 	KASSERT(cr->cr_agroups >= ngrp, ("cr_ngroups is too small"));
2319 
2320 	bcopy(groups, cr->cr_groups, ngrp * sizeof(gid_t));
2321 	cr->cr_ngroups = ngrp;
2322 
2323 	/*
2324 	 * Sort all groups except cr_groups[0] to allow groupmember to
2325 	 * perform a binary search.
2326 	 *
2327 	 * XXX: If large numbers of groups become common this should
2328 	 * be replaced with shell sort like linux uses or possibly
2329 	 * heap sort.
2330 	 */
2331 	for (i = 2; i < ngrp; i++) {
2332 		g = cr->cr_groups[i];
2333 		for (j = i-1; j >= 1 && g < cr->cr_groups[j]; j--)
2334 			cr->cr_groups[j + 1] = cr->cr_groups[j];
2335 		cr->cr_groups[j + 1] = g;
2336 	}
2337 }
2338 
2339 /*
2340  * Copy groups in to a credential after expanding it if required.
2341  * Truncate the list to (ngroups_max + 1) if it is too large.
2342  */
2343 void
2344 crsetgroups(struct ucred *cr, int ngrp, gid_t *groups)
2345 {
2346 
2347 	if (ngrp > ngroups_max + 1)
2348 		ngrp = ngroups_max + 1;
2349 
2350 	crextend(cr, ngrp);
2351 	crsetgroups_locked(cr, ngrp, groups);
2352 }
2353 
2354 /*
2355  * Get login name, if available.
2356  */
2357 #ifndef _SYS_SYSPROTO_H_
2358 struct getlogin_args {
2359 	char	*namebuf;
2360 	u_int	namelen;
2361 };
2362 #endif
2363 /* ARGSUSED */
2364 int
2365 sys_getlogin(struct thread *td, struct getlogin_args *uap)
2366 {
2367 	char login[MAXLOGNAME];
2368 	struct proc *p = td->td_proc;
2369 	size_t len;
2370 
2371 	if (uap->namelen > MAXLOGNAME)
2372 		uap->namelen = MAXLOGNAME;
2373 	PROC_LOCK(p);
2374 	SESS_LOCK(p->p_session);
2375 	len = strlcpy(login, p->p_session->s_login, uap->namelen) + 1;
2376 	SESS_UNLOCK(p->p_session);
2377 	PROC_UNLOCK(p);
2378 	if (len > uap->namelen)
2379 		return (ERANGE);
2380 	return (copyout(login, uap->namebuf, len));
2381 }
2382 
2383 /*
2384  * Set login name.
2385  */
2386 #ifndef _SYS_SYSPROTO_H_
2387 struct setlogin_args {
2388 	char	*namebuf;
2389 };
2390 #endif
2391 /* ARGSUSED */
2392 int
2393 sys_setlogin(struct thread *td, struct setlogin_args *uap)
2394 {
2395 	struct proc *p = td->td_proc;
2396 	int error;
2397 	char logintmp[MAXLOGNAME];
2398 
2399 	CTASSERT(sizeof(p->p_session->s_login) >= sizeof(logintmp));
2400 
2401 	error = priv_check(td, PRIV_PROC_SETLOGIN);
2402 	if (error)
2403 		return (error);
2404 	error = copyinstr(uap->namebuf, logintmp, sizeof(logintmp), NULL);
2405 	if (error != 0) {
2406 		if (error == ENAMETOOLONG)
2407 			error = EINVAL;
2408 		return (error);
2409 	}
2410 	AUDIT_ARG_LOGIN(logintmp);
2411 	PROC_LOCK(p);
2412 	SESS_LOCK(p->p_session);
2413 	strcpy(p->p_session->s_login, logintmp);
2414 	SESS_UNLOCK(p->p_session);
2415 	PROC_UNLOCK(p);
2416 	return (0);
2417 }
2418 
2419 void
2420 setsugid(struct proc *p)
2421 {
2422 
2423 	PROC_LOCK_ASSERT(p, MA_OWNED);
2424 	p->p_flag |= P_SUGID;
2425 }
2426 
2427 /*-
2428  * Change a process's effective uid.
2429  * Side effects: newcred->cr_uid and newcred->cr_uidinfo will be modified.
2430  * References: newcred must be an exclusive credential reference for the
2431  *             duration of the call.
2432  */
2433 void
2434 change_euid(struct ucred *newcred, struct uidinfo *euip)
2435 {
2436 
2437 	newcred->cr_uid = euip->ui_uid;
2438 	uihold(euip);
2439 	uifree(newcred->cr_uidinfo);
2440 	newcred->cr_uidinfo = euip;
2441 }
2442 
2443 /*-
2444  * Change a process's effective gid.
2445  * Side effects: newcred->cr_gid will be modified.
2446  * References: newcred must be an exclusive credential reference for the
2447  *             duration of the call.
2448  */
2449 void
2450 change_egid(struct ucred *newcred, gid_t egid)
2451 {
2452 
2453 	newcred->cr_groups[0] = egid;
2454 }
2455 
2456 /*-
2457  * Change a process's real uid.
2458  * Side effects: newcred->cr_ruid will be updated, newcred->cr_ruidinfo
2459  *               will be updated, and the old and new cr_ruidinfo proc
2460  *               counts will be updated.
2461  * References: newcred must be an exclusive credential reference for the
2462  *             duration of the call.
2463  */
2464 void
2465 change_ruid(struct ucred *newcred, struct uidinfo *ruip)
2466 {
2467 
2468 	(void)chgproccnt(newcred->cr_ruidinfo, -1, 0);
2469 	newcred->cr_ruid = ruip->ui_uid;
2470 	uihold(ruip);
2471 	uifree(newcred->cr_ruidinfo);
2472 	newcred->cr_ruidinfo = ruip;
2473 	(void)chgproccnt(newcred->cr_ruidinfo, 1, 0);
2474 }
2475 
2476 /*-
2477  * Change a process's real gid.
2478  * Side effects: newcred->cr_rgid will be updated.
2479  * References: newcred must be an exclusive credential reference for the
2480  *             duration of the call.
2481  */
2482 void
2483 change_rgid(struct ucred *newcred, gid_t rgid)
2484 {
2485 
2486 	newcred->cr_rgid = rgid;
2487 }
2488 
2489 /*-
2490  * Change a process's saved uid.
2491  * Side effects: newcred->cr_svuid will be updated.
2492  * References: newcred must be an exclusive credential reference for the
2493  *             duration of the call.
2494  */
2495 void
2496 change_svuid(struct ucred *newcred, uid_t svuid)
2497 {
2498 
2499 	newcred->cr_svuid = svuid;
2500 }
2501 
2502 /*-
2503  * Change a process's saved gid.
2504  * Side effects: newcred->cr_svgid will be updated.
2505  * References: newcred must be an exclusive credential reference for the
2506  *             duration of the call.
2507  */
2508 void
2509 change_svgid(struct ucred *newcred, gid_t svgid)
2510 {
2511 
2512 	newcred->cr_svgid = svgid;
2513 }
2514 
2515 bool allow_ptrace = true;
2516 SYSCTL_BOOL(_security_bsd, OID_AUTO, allow_ptrace, CTLFLAG_RWTUN,
2517     &allow_ptrace, 0,
2518     "Deny ptrace(2) use by returning ENOSYS");
2519