xref: /freebsd/sys/kern/kern_prot.c (revision 56e53cb8ef000c3ef72337a4095987a932cdedef)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1989, 1990, 1991, 1993
5  *	The Regents of the University of California.
6  * (c) UNIX System Laboratories, Inc.
7  * Copyright (c) 2000-2001 Robert N. M. Watson.
8  * All rights reserved.
9  *
10  * All or some portions of this file are derived from material licensed
11  * to the University of California by American Telephone and Telegraph
12  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
13  * the permission of UNIX System Laboratories, Inc.
14  *
15  * Redistribution and use in source and binary forms, with or without
16  * modification, are permitted provided that the following conditions
17  * are met:
18  * 1. Redistributions of source code must retain the above copyright
19  *    notice, this list of conditions and the following disclaimer.
20  * 2. Redistributions in binary form must reproduce the above copyright
21  *    notice, this list of conditions and the following disclaimer in the
22  *    documentation and/or other materials provided with the distribution.
23  * 3. Neither the name of the University nor the names of its contributors
24  *    may be used to endorse or promote products derived from this software
25  *    without specific prior written permission.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
28  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
29  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
30  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
31  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
32  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
33  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
34  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
35  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
36  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37  * SUCH DAMAGE.
38  *
39  *	@(#)kern_prot.c	8.6 (Berkeley) 1/21/94
40  */
41 
42 /*
43  * System calls related to processes and protection
44  */
45 
46 #include <sys/cdefs.h>
47 __FBSDID("$FreeBSD$");
48 
49 #include "opt_compat.h"
50 #include "opt_inet.h"
51 #include "opt_inet6.h"
52 
53 #include <sys/param.h>
54 #include <sys/systm.h>
55 #include <sys/acct.h>
56 #include <sys/kdb.h>
57 #include <sys/kernel.h>
58 #include <sys/lock.h>
59 #include <sys/loginclass.h>
60 #include <sys/malloc.h>
61 #include <sys/mutex.h>
62 #include <sys/refcount.h>
63 #include <sys/sx.h>
64 #include <sys/priv.h>
65 #include <sys/proc.h>
66 #include <sys/sysproto.h>
67 #include <sys/jail.h>
68 #include <sys/pioctl.h>
69 #include <sys/racct.h>
70 #include <sys/resourcevar.h>
71 #include <sys/socket.h>
72 #include <sys/socketvar.h>
73 #include <sys/syscallsubr.h>
74 #include <sys/sysctl.h>
75 
76 #ifdef REGRESSION
77 FEATURE(regression,
78     "Kernel support for interfaces necessary for regression testing (SECURITY RISK!)");
79 #endif
80 
81 #include <security/audit/audit.h>
82 #include <security/mac/mac_framework.h>
83 
84 static MALLOC_DEFINE(M_CRED, "cred", "credentials");
85 
86 SYSCTL_NODE(_security, OID_AUTO, bsd, CTLFLAG_RW, 0, "BSD security policy");
87 
88 static void crsetgroups_locked(struct ucred *cr, int ngrp,
89     gid_t *groups);
90 
91 #ifndef _SYS_SYSPROTO_H_
92 struct getpid_args {
93 	int	dummy;
94 };
95 #endif
96 /* ARGSUSED */
97 int
98 sys_getpid(struct thread *td, struct getpid_args *uap)
99 {
100 	struct proc *p = td->td_proc;
101 
102 	td->td_retval[0] = p->p_pid;
103 #if defined(COMPAT_43)
104 	td->td_retval[1] = kern_getppid(td);
105 #endif
106 	return (0);
107 }
108 
109 #ifndef _SYS_SYSPROTO_H_
110 struct getppid_args {
111         int     dummy;
112 };
113 #endif
114 /* ARGSUSED */
115 int
116 sys_getppid(struct thread *td, struct getppid_args *uap)
117 {
118 
119 	td->td_retval[0] = kern_getppid(td);
120 	return (0);
121 }
122 
123 int
124 kern_getppid(struct thread *td)
125 {
126 	struct proc *p = td->td_proc;
127 	struct proc *pp;
128 	int ppid;
129 
130 	PROC_LOCK(p);
131 	if (!(p->p_flag & P_TRACED)) {
132 		ppid = p->p_pptr->p_pid;
133 		PROC_UNLOCK(p);
134 	} else {
135 		PROC_UNLOCK(p);
136 		sx_slock(&proctree_lock);
137 		pp = proc_realparent(p);
138 		ppid = pp->p_pid;
139 		sx_sunlock(&proctree_lock);
140 	}
141 
142 	return (ppid);
143 }
144 
145 /*
146  * Get process group ID; note that POSIX getpgrp takes no parameter.
147  */
148 #ifndef _SYS_SYSPROTO_H_
149 struct getpgrp_args {
150         int     dummy;
151 };
152 #endif
153 int
154 sys_getpgrp(struct thread *td, struct getpgrp_args *uap)
155 {
156 	struct proc *p = td->td_proc;
157 
158 	PROC_LOCK(p);
159 	td->td_retval[0] = p->p_pgrp->pg_id;
160 	PROC_UNLOCK(p);
161 	return (0);
162 }
163 
164 /* Get an arbitrary pid's process group id */
165 #ifndef _SYS_SYSPROTO_H_
166 struct getpgid_args {
167 	pid_t	pid;
168 };
169 #endif
170 int
171 sys_getpgid(struct thread *td, struct getpgid_args *uap)
172 {
173 	struct proc *p;
174 	int error;
175 
176 	if (uap->pid == 0) {
177 		p = td->td_proc;
178 		PROC_LOCK(p);
179 	} else {
180 		p = pfind(uap->pid);
181 		if (p == NULL)
182 			return (ESRCH);
183 		error = p_cansee(td, p);
184 		if (error) {
185 			PROC_UNLOCK(p);
186 			return (error);
187 		}
188 	}
189 	td->td_retval[0] = p->p_pgrp->pg_id;
190 	PROC_UNLOCK(p);
191 	return (0);
192 }
193 
194 /*
195  * Get an arbitrary pid's session id.
196  */
197 #ifndef _SYS_SYSPROTO_H_
198 struct getsid_args {
199 	pid_t	pid;
200 };
201 #endif
202 int
203 sys_getsid(struct thread *td, struct getsid_args *uap)
204 {
205 	struct proc *p;
206 	int error;
207 
208 	if (uap->pid == 0) {
209 		p = td->td_proc;
210 		PROC_LOCK(p);
211 	} else {
212 		p = pfind(uap->pid);
213 		if (p == NULL)
214 			return (ESRCH);
215 		error = p_cansee(td, p);
216 		if (error) {
217 			PROC_UNLOCK(p);
218 			return (error);
219 		}
220 	}
221 	td->td_retval[0] = p->p_session->s_sid;
222 	PROC_UNLOCK(p);
223 	return (0);
224 }
225 
226 #ifndef _SYS_SYSPROTO_H_
227 struct getuid_args {
228         int     dummy;
229 };
230 #endif
231 /* ARGSUSED */
232 int
233 sys_getuid(struct thread *td, struct getuid_args *uap)
234 {
235 
236 	td->td_retval[0] = td->td_ucred->cr_ruid;
237 #if defined(COMPAT_43)
238 	td->td_retval[1] = td->td_ucred->cr_uid;
239 #endif
240 	return (0);
241 }
242 
243 #ifndef _SYS_SYSPROTO_H_
244 struct geteuid_args {
245         int     dummy;
246 };
247 #endif
248 /* ARGSUSED */
249 int
250 sys_geteuid(struct thread *td, struct geteuid_args *uap)
251 {
252 
253 	td->td_retval[0] = td->td_ucred->cr_uid;
254 	return (0);
255 }
256 
257 #ifndef _SYS_SYSPROTO_H_
258 struct getgid_args {
259         int     dummy;
260 };
261 #endif
262 /* ARGSUSED */
263 int
264 sys_getgid(struct thread *td, struct getgid_args *uap)
265 {
266 
267 	td->td_retval[0] = td->td_ucred->cr_rgid;
268 #if defined(COMPAT_43)
269 	td->td_retval[1] = td->td_ucred->cr_groups[0];
270 #endif
271 	return (0);
272 }
273 
274 /*
275  * Get effective group ID.  The "egid" is groups[0], and could be obtained
276  * via getgroups.  This syscall exists because it is somewhat painful to do
277  * correctly in a library function.
278  */
279 #ifndef _SYS_SYSPROTO_H_
280 struct getegid_args {
281         int     dummy;
282 };
283 #endif
284 /* ARGSUSED */
285 int
286 sys_getegid(struct thread *td, struct getegid_args *uap)
287 {
288 
289 	td->td_retval[0] = td->td_ucred->cr_groups[0];
290 	return (0);
291 }
292 
293 #ifndef _SYS_SYSPROTO_H_
294 struct getgroups_args {
295 	u_int	gidsetsize;
296 	gid_t	*gidset;
297 };
298 #endif
299 int
300 sys_getgroups(struct thread *td, struct getgroups_args *uap)
301 {
302 	struct ucred *cred;
303 	u_int ngrp;
304 	int error;
305 
306 	cred = td->td_ucred;
307 	ngrp = cred->cr_ngroups;
308 
309 	if (uap->gidsetsize == 0) {
310 		error = 0;
311 		goto out;
312 	}
313 	if (uap->gidsetsize < ngrp)
314 		return (EINVAL);
315 
316 	error = copyout(cred->cr_groups, uap->gidset, ngrp * sizeof(gid_t));
317 out:
318 	td->td_retval[0] = ngrp;
319 	return (error);
320 }
321 
322 #ifndef _SYS_SYSPROTO_H_
323 struct setsid_args {
324         int     dummy;
325 };
326 #endif
327 /* ARGSUSED */
328 int
329 sys_setsid(struct thread *td, struct setsid_args *uap)
330 {
331 	struct pgrp *pgrp;
332 	int error;
333 	struct proc *p = td->td_proc;
334 	struct pgrp *newpgrp;
335 	struct session *newsess;
336 
337 	error = 0;
338 	pgrp = NULL;
339 
340 	newpgrp = malloc(sizeof(struct pgrp), M_PGRP, M_WAITOK | M_ZERO);
341 	newsess = malloc(sizeof(struct session), M_SESSION, M_WAITOK | M_ZERO);
342 
343 	sx_xlock(&proctree_lock);
344 
345 	if (p->p_pgid == p->p_pid || (pgrp = pgfind(p->p_pid)) != NULL) {
346 		if (pgrp != NULL)
347 			PGRP_UNLOCK(pgrp);
348 		error = EPERM;
349 	} else {
350 		(void)enterpgrp(p, p->p_pid, newpgrp, newsess);
351 		td->td_retval[0] = p->p_pid;
352 		newpgrp = NULL;
353 		newsess = NULL;
354 	}
355 
356 	sx_xunlock(&proctree_lock);
357 
358 	if (newpgrp != NULL)
359 		free(newpgrp, M_PGRP);
360 	if (newsess != NULL)
361 		free(newsess, M_SESSION);
362 
363 	return (error);
364 }
365 
366 /*
367  * set process group (setpgid/old setpgrp)
368  *
369  * caller does setpgid(targpid, targpgid)
370  *
371  * pid must be caller or child of caller (ESRCH)
372  * if a child
373  *	pid must be in same session (EPERM)
374  *	pid can't have done an exec (EACCES)
375  * if pgid != pid
376  * 	there must exist some pid in same session having pgid (EPERM)
377  * pid must not be session leader (EPERM)
378  */
379 #ifndef _SYS_SYSPROTO_H_
380 struct setpgid_args {
381 	int	pid;		/* target process id */
382 	int	pgid;		/* target pgrp id */
383 };
384 #endif
385 /* ARGSUSED */
386 int
387 sys_setpgid(struct thread *td, struct setpgid_args *uap)
388 {
389 	struct proc *curp = td->td_proc;
390 	struct proc *targp;	/* target process */
391 	struct pgrp *pgrp;	/* target pgrp */
392 	int error;
393 	struct pgrp *newpgrp;
394 
395 	if (uap->pgid < 0)
396 		return (EINVAL);
397 
398 	error = 0;
399 
400 	newpgrp = malloc(sizeof(struct pgrp), M_PGRP, M_WAITOK | M_ZERO);
401 
402 	sx_xlock(&proctree_lock);
403 	if (uap->pid != 0 && uap->pid != curp->p_pid) {
404 		if ((targp = pfind(uap->pid)) == NULL) {
405 			error = ESRCH;
406 			goto done;
407 		}
408 		if (!inferior(targp)) {
409 			PROC_UNLOCK(targp);
410 			error = ESRCH;
411 			goto done;
412 		}
413 		if ((error = p_cansee(td, targp))) {
414 			PROC_UNLOCK(targp);
415 			goto done;
416 		}
417 		if (targp->p_pgrp == NULL ||
418 		    targp->p_session != curp->p_session) {
419 			PROC_UNLOCK(targp);
420 			error = EPERM;
421 			goto done;
422 		}
423 		if (targp->p_flag & P_EXEC) {
424 			PROC_UNLOCK(targp);
425 			error = EACCES;
426 			goto done;
427 		}
428 		PROC_UNLOCK(targp);
429 	} else
430 		targp = curp;
431 	if (SESS_LEADER(targp)) {
432 		error = EPERM;
433 		goto done;
434 	}
435 	if (uap->pgid == 0)
436 		uap->pgid = targp->p_pid;
437 	if ((pgrp = pgfind(uap->pgid)) == NULL) {
438 		if (uap->pgid == targp->p_pid) {
439 			error = enterpgrp(targp, uap->pgid, newpgrp,
440 			    NULL);
441 			if (error == 0)
442 				newpgrp = NULL;
443 		} else
444 			error = EPERM;
445 	} else {
446 		if (pgrp == targp->p_pgrp) {
447 			PGRP_UNLOCK(pgrp);
448 			goto done;
449 		}
450 		if (pgrp->pg_id != targp->p_pid &&
451 		    pgrp->pg_session != curp->p_session) {
452 			PGRP_UNLOCK(pgrp);
453 			error = EPERM;
454 			goto done;
455 		}
456 		PGRP_UNLOCK(pgrp);
457 		error = enterthispgrp(targp, pgrp);
458 	}
459 done:
460 	sx_xunlock(&proctree_lock);
461 	KASSERT((error == 0) || (newpgrp != NULL),
462 	    ("setpgid failed and newpgrp is NULL"));
463 	if (newpgrp != NULL)
464 		free(newpgrp, M_PGRP);
465 	return (error);
466 }
467 
468 /*
469  * Use the clause in B.4.2.2 that allows setuid/setgid to be 4.2/4.3BSD
470  * compatible.  It says that setting the uid/gid to euid/egid is a special
471  * case of "appropriate privilege".  Once the rules are expanded out, this
472  * basically means that setuid(nnn) sets all three id's, in all permitted
473  * cases unless _POSIX_SAVED_IDS is enabled.  In that case, setuid(getuid())
474  * does not set the saved id - this is dangerous for traditional BSD
475  * programs.  For this reason, we *really* do not want to set
476  * _POSIX_SAVED_IDS and do not want to clear POSIX_APPENDIX_B_4_2_2.
477  */
478 #define POSIX_APPENDIX_B_4_2_2
479 
480 #ifndef _SYS_SYSPROTO_H_
481 struct setuid_args {
482 	uid_t	uid;
483 };
484 #endif
485 /* ARGSUSED */
486 int
487 sys_setuid(struct thread *td, struct setuid_args *uap)
488 {
489 	struct proc *p = td->td_proc;
490 	struct ucred *newcred, *oldcred;
491 	uid_t uid;
492 	struct uidinfo *uip;
493 	int error;
494 
495 	uid = uap->uid;
496 	AUDIT_ARG_UID(uid);
497 	newcred = crget();
498 	uip = uifind(uid);
499 	PROC_LOCK(p);
500 	/*
501 	 * Copy credentials so other references do not see our changes.
502 	 */
503 	oldcred = crcopysafe(p, newcred);
504 
505 #ifdef MAC
506 	error = mac_cred_check_setuid(oldcred, uid);
507 	if (error)
508 		goto fail;
509 #endif
510 
511 	/*
512 	 * See if we have "permission" by POSIX 1003.1 rules.
513 	 *
514 	 * Note that setuid(geteuid()) is a special case of
515 	 * "appropriate privileges" in appendix B.4.2.2.  We need
516 	 * to use this clause to be compatible with traditional BSD
517 	 * semantics.  Basically, it means that "setuid(xx)" sets all
518 	 * three id's (assuming you have privs).
519 	 *
520 	 * Notes on the logic.  We do things in three steps.
521 	 * 1: We determine if the euid is going to change, and do EPERM
522 	 *    right away.  We unconditionally change the euid later if this
523 	 *    test is satisfied, simplifying that part of the logic.
524 	 * 2: We determine if the real and/or saved uids are going to
525 	 *    change.  Determined by compile options.
526 	 * 3: Change euid last. (after tests in #2 for "appropriate privs")
527 	 */
528 	if (uid != oldcred->cr_ruid &&		/* allow setuid(getuid()) */
529 #ifdef _POSIX_SAVED_IDS
530 	    uid != oldcred->cr_svuid &&		/* allow setuid(saved gid) */
531 #endif
532 #ifdef POSIX_APPENDIX_B_4_2_2	/* Use BSD-compat clause from B.4.2.2 */
533 	    uid != oldcred->cr_uid &&		/* allow setuid(geteuid()) */
534 #endif
535 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETUID, 0)) != 0)
536 		goto fail;
537 
538 #ifdef _POSIX_SAVED_IDS
539 	/*
540 	 * Do we have "appropriate privileges" (are we root or uid == euid)
541 	 * If so, we are changing the real uid and/or saved uid.
542 	 */
543 	if (
544 #ifdef POSIX_APPENDIX_B_4_2_2	/* Use the clause from B.4.2.2 */
545 	    uid == oldcred->cr_uid ||
546 #endif
547 	    /* We are using privs. */
548 	    priv_check_cred(oldcred, PRIV_CRED_SETUID, 0) == 0)
549 #endif
550 	{
551 		/*
552 		 * Set the real uid and transfer proc count to new user.
553 		 */
554 		if (uid != oldcred->cr_ruid) {
555 			change_ruid(newcred, uip);
556 			setsugid(p);
557 		}
558 		/*
559 		 * Set saved uid
560 		 *
561 		 * XXX always set saved uid even if not _POSIX_SAVED_IDS, as
562 		 * the security of seteuid() depends on it.  B.4.2.2 says it
563 		 * is important that we should do this.
564 		 */
565 		if (uid != oldcred->cr_svuid) {
566 			change_svuid(newcred, uid);
567 			setsugid(p);
568 		}
569 	}
570 
571 	/*
572 	 * In all permitted cases, we are changing the euid.
573 	 */
574 	if (uid != oldcred->cr_uid) {
575 		change_euid(newcred, uip);
576 		setsugid(p);
577 	}
578 	proc_set_cred(p, newcred);
579 	PROC_UNLOCK(p);
580 #ifdef RACCT
581 	racct_proc_ucred_changed(p, oldcred, newcred);
582 #endif
583 	uifree(uip);
584 	crfree(oldcred);
585 	return (0);
586 
587 fail:
588 	PROC_UNLOCK(p);
589 	uifree(uip);
590 	crfree(newcred);
591 	return (error);
592 }
593 
594 #ifndef _SYS_SYSPROTO_H_
595 struct seteuid_args {
596 	uid_t	euid;
597 };
598 #endif
599 /* ARGSUSED */
600 int
601 sys_seteuid(struct thread *td, struct seteuid_args *uap)
602 {
603 	struct proc *p = td->td_proc;
604 	struct ucred *newcred, *oldcred;
605 	uid_t euid;
606 	struct uidinfo *euip;
607 	int error;
608 
609 	euid = uap->euid;
610 	AUDIT_ARG_EUID(euid);
611 	newcred = crget();
612 	euip = uifind(euid);
613 	PROC_LOCK(p);
614 	/*
615 	 * Copy credentials so other references do not see our changes.
616 	 */
617 	oldcred = crcopysafe(p, newcred);
618 
619 #ifdef MAC
620 	error = mac_cred_check_seteuid(oldcred, euid);
621 	if (error)
622 		goto fail;
623 #endif
624 
625 	if (euid != oldcred->cr_ruid &&		/* allow seteuid(getuid()) */
626 	    euid != oldcred->cr_svuid &&	/* allow seteuid(saved uid) */
627 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETEUID, 0)) != 0)
628 		goto fail;
629 
630 	/*
631 	 * Everything's okay, do it.
632 	 */
633 	if (oldcred->cr_uid != euid) {
634 		change_euid(newcred, euip);
635 		setsugid(p);
636 	}
637 	proc_set_cred(p, newcred);
638 	PROC_UNLOCK(p);
639 	uifree(euip);
640 	crfree(oldcred);
641 	return (0);
642 
643 fail:
644 	PROC_UNLOCK(p);
645 	uifree(euip);
646 	crfree(newcred);
647 	return (error);
648 }
649 
650 #ifndef _SYS_SYSPROTO_H_
651 struct setgid_args {
652 	gid_t	gid;
653 };
654 #endif
655 /* ARGSUSED */
656 int
657 sys_setgid(struct thread *td, struct setgid_args *uap)
658 {
659 	struct proc *p = td->td_proc;
660 	struct ucred *newcred, *oldcred;
661 	gid_t gid;
662 	int error;
663 
664 	gid = uap->gid;
665 	AUDIT_ARG_GID(gid);
666 	newcred = crget();
667 	PROC_LOCK(p);
668 	oldcred = crcopysafe(p, newcred);
669 
670 #ifdef MAC
671 	error = mac_cred_check_setgid(oldcred, gid);
672 	if (error)
673 		goto fail;
674 #endif
675 
676 	/*
677 	 * See if we have "permission" by POSIX 1003.1 rules.
678 	 *
679 	 * Note that setgid(getegid()) is a special case of
680 	 * "appropriate privileges" in appendix B.4.2.2.  We need
681 	 * to use this clause to be compatible with traditional BSD
682 	 * semantics.  Basically, it means that "setgid(xx)" sets all
683 	 * three id's (assuming you have privs).
684 	 *
685 	 * For notes on the logic here, see setuid() above.
686 	 */
687 	if (gid != oldcred->cr_rgid &&		/* allow setgid(getgid()) */
688 #ifdef _POSIX_SAVED_IDS
689 	    gid != oldcred->cr_svgid &&		/* allow setgid(saved gid) */
690 #endif
691 #ifdef POSIX_APPENDIX_B_4_2_2	/* Use BSD-compat clause from B.4.2.2 */
692 	    gid != oldcred->cr_groups[0] && /* allow setgid(getegid()) */
693 #endif
694 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETGID, 0)) != 0)
695 		goto fail;
696 
697 #ifdef _POSIX_SAVED_IDS
698 	/*
699 	 * Do we have "appropriate privileges" (are we root or gid == egid)
700 	 * If so, we are changing the real uid and saved gid.
701 	 */
702 	if (
703 #ifdef POSIX_APPENDIX_B_4_2_2	/* use the clause from B.4.2.2 */
704 	    gid == oldcred->cr_groups[0] ||
705 #endif
706 	    /* We are using privs. */
707 	    priv_check_cred(oldcred, PRIV_CRED_SETGID, 0) == 0)
708 #endif
709 	{
710 		/*
711 		 * Set real gid
712 		 */
713 		if (oldcred->cr_rgid != gid) {
714 			change_rgid(newcred, gid);
715 			setsugid(p);
716 		}
717 		/*
718 		 * Set saved gid
719 		 *
720 		 * XXX always set saved gid even if not _POSIX_SAVED_IDS, as
721 		 * the security of setegid() depends on it.  B.4.2.2 says it
722 		 * is important that we should do this.
723 		 */
724 		if (oldcred->cr_svgid != gid) {
725 			change_svgid(newcred, gid);
726 			setsugid(p);
727 		}
728 	}
729 	/*
730 	 * In all cases permitted cases, we are changing the egid.
731 	 * Copy credentials so other references do not see our changes.
732 	 */
733 	if (oldcred->cr_groups[0] != gid) {
734 		change_egid(newcred, gid);
735 		setsugid(p);
736 	}
737 	proc_set_cred(p, newcred);
738 	PROC_UNLOCK(p);
739 	crfree(oldcred);
740 	return (0);
741 
742 fail:
743 	PROC_UNLOCK(p);
744 	crfree(newcred);
745 	return (error);
746 }
747 
748 #ifndef _SYS_SYSPROTO_H_
749 struct setegid_args {
750 	gid_t	egid;
751 };
752 #endif
753 /* ARGSUSED */
754 int
755 sys_setegid(struct thread *td, struct setegid_args *uap)
756 {
757 	struct proc *p = td->td_proc;
758 	struct ucred *newcred, *oldcred;
759 	gid_t egid;
760 	int error;
761 
762 	egid = uap->egid;
763 	AUDIT_ARG_EGID(egid);
764 	newcred = crget();
765 	PROC_LOCK(p);
766 	oldcred = crcopysafe(p, newcred);
767 
768 #ifdef MAC
769 	error = mac_cred_check_setegid(oldcred, egid);
770 	if (error)
771 		goto fail;
772 #endif
773 
774 	if (egid != oldcred->cr_rgid &&		/* allow setegid(getgid()) */
775 	    egid != oldcred->cr_svgid &&	/* allow setegid(saved gid) */
776 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETEGID, 0)) != 0)
777 		goto fail;
778 
779 	if (oldcred->cr_groups[0] != egid) {
780 		change_egid(newcred, egid);
781 		setsugid(p);
782 	}
783 	proc_set_cred(p, newcred);
784 	PROC_UNLOCK(p);
785 	crfree(oldcred);
786 	return (0);
787 
788 fail:
789 	PROC_UNLOCK(p);
790 	crfree(newcred);
791 	return (error);
792 }
793 
794 #ifndef _SYS_SYSPROTO_H_
795 struct setgroups_args {
796 	u_int	gidsetsize;
797 	gid_t	*gidset;
798 };
799 #endif
800 /* ARGSUSED */
801 int
802 sys_setgroups(struct thread *td, struct setgroups_args *uap)
803 {
804 	gid_t smallgroups[XU_NGROUPS];
805 	gid_t *groups;
806 	u_int gidsetsize;
807 	int error;
808 
809 	gidsetsize = uap->gidsetsize;
810 	if (gidsetsize > ngroups_max + 1)
811 		return (EINVAL);
812 
813 	if (gidsetsize > XU_NGROUPS)
814 		groups = malloc(gidsetsize * sizeof(gid_t), M_TEMP, M_WAITOK);
815 	else
816 		groups = smallgroups;
817 
818 	error = copyin(uap->gidset, groups, gidsetsize * sizeof(gid_t));
819 	if (error == 0)
820 		error = kern_setgroups(td, gidsetsize, groups);
821 
822 	if (gidsetsize > XU_NGROUPS)
823 		free(groups, M_TEMP);
824 	return (error);
825 }
826 
827 int
828 kern_setgroups(struct thread *td, u_int ngrp, gid_t *groups)
829 {
830 	struct proc *p = td->td_proc;
831 	struct ucred *newcred, *oldcred;
832 	int error;
833 
834 	MPASS(ngrp <= ngroups_max + 1);
835 	AUDIT_ARG_GROUPSET(groups, ngrp);
836 	newcred = crget();
837 	crextend(newcred, ngrp);
838 	PROC_LOCK(p);
839 	oldcred = crcopysafe(p, newcred);
840 
841 #ifdef MAC
842 	error = mac_cred_check_setgroups(oldcred, ngrp, groups);
843 	if (error)
844 		goto fail;
845 #endif
846 
847 	error = priv_check_cred(oldcred, PRIV_CRED_SETGROUPS, 0);
848 	if (error)
849 		goto fail;
850 
851 	if (ngrp == 0) {
852 		/*
853 		 * setgroups(0, NULL) is a legitimate way of clearing the
854 		 * groups vector on non-BSD systems (which generally do not
855 		 * have the egid in the groups[0]).  We risk security holes
856 		 * when running non-BSD software if we do not do the same.
857 		 */
858 		newcred->cr_ngroups = 1;
859 	} else {
860 		crsetgroups_locked(newcred, ngrp, groups);
861 	}
862 	setsugid(p);
863 	proc_set_cred(p, newcred);
864 	PROC_UNLOCK(p);
865 	crfree(oldcred);
866 	return (0);
867 
868 fail:
869 	PROC_UNLOCK(p);
870 	crfree(newcred);
871 	return (error);
872 }
873 
874 #ifndef _SYS_SYSPROTO_H_
875 struct setreuid_args {
876 	uid_t	ruid;
877 	uid_t	euid;
878 };
879 #endif
880 /* ARGSUSED */
881 int
882 sys_setreuid(struct thread *td, struct setreuid_args *uap)
883 {
884 	struct proc *p = td->td_proc;
885 	struct ucred *newcred, *oldcred;
886 	uid_t euid, ruid;
887 	struct uidinfo *euip, *ruip;
888 	int error;
889 
890 	euid = uap->euid;
891 	ruid = uap->ruid;
892 	AUDIT_ARG_EUID(euid);
893 	AUDIT_ARG_RUID(ruid);
894 	newcred = crget();
895 	euip = uifind(euid);
896 	ruip = uifind(ruid);
897 	PROC_LOCK(p);
898 	oldcred = crcopysafe(p, newcred);
899 
900 #ifdef MAC
901 	error = mac_cred_check_setreuid(oldcred, ruid, euid);
902 	if (error)
903 		goto fail;
904 #endif
905 
906 	if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid &&
907 	      ruid != oldcred->cr_svuid) ||
908 	     (euid != (uid_t)-1 && euid != oldcred->cr_uid &&
909 	      euid != oldcred->cr_ruid && euid != oldcred->cr_svuid)) &&
910 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETREUID, 0)) != 0)
911 		goto fail;
912 
913 	if (euid != (uid_t)-1 && oldcred->cr_uid != euid) {
914 		change_euid(newcred, euip);
915 		setsugid(p);
916 	}
917 	if (ruid != (uid_t)-1 && oldcred->cr_ruid != ruid) {
918 		change_ruid(newcred, ruip);
919 		setsugid(p);
920 	}
921 	if ((ruid != (uid_t)-1 || newcred->cr_uid != newcred->cr_ruid) &&
922 	    newcred->cr_svuid != newcred->cr_uid) {
923 		change_svuid(newcred, newcred->cr_uid);
924 		setsugid(p);
925 	}
926 	proc_set_cred(p, newcred);
927 	PROC_UNLOCK(p);
928 #ifdef RACCT
929 	racct_proc_ucred_changed(p, oldcred, newcred);
930 #endif
931 	uifree(ruip);
932 	uifree(euip);
933 	crfree(oldcred);
934 	return (0);
935 
936 fail:
937 	PROC_UNLOCK(p);
938 	uifree(ruip);
939 	uifree(euip);
940 	crfree(newcred);
941 	return (error);
942 }
943 
944 #ifndef _SYS_SYSPROTO_H_
945 struct setregid_args {
946 	gid_t	rgid;
947 	gid_t	egid;
948 };
949 #endif
950 /* ARGSUSED */
951 int
952 sys_setregid(struct thread *td, struct setregid_args *uap)
953 {
954 	struct proc *p = td->td_proc;
955 	struct ucred *newcred, *oldcred;
956 	gid_t egid, rgid;
957 	int error;
958 
959 	egid = uap->egid;
960 	rgid = uap->rgid;
961 	AUDIT_ARG_EGID(egid);
962 	AUDIT_ARG_RGID(rgid);
963 	newcred = crget();
964 	PROC_LOCK(p);
965 	oldcred = crcopysafe(p, newcred);
966 
967 #ifdef MAC
968 	error = mac_cred_check_setregid(oldcred, rgid, egid);
969 	if (error)
970 		goto fail;
971 #endif
972 
973 	if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid &&
974 	    rgid != oldcred->cr_svgid) ||
975 	     (egid != (gid_t)-1 && egid != oldcred->cr_groups[0] &&
976 	     egid != oldcred->cr_rgid && egid != oldcred->cr_svgid)) &&
977 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETREGID, 0)) != 0)
978 		goto fail;
979 
980 	if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) {
981 		change_egid(newcred, egid);
982 		setsugid(p);
983 	}
984 	if (rgid != (gid_t)-1 && oldcred->cr_rgid != rgid) {
985 		change_rgid(newcred, rgid);
986 		setsugid(p);
987 	}
988 	if ((rgid != (gid_t)-1 || newcred->cr_groups[0] != newcred->cr_rgid) &&
989 	    newcred->cr_svgid != newcred->cr_groups[0]) {
990 		change_svgid(newcred, newcred->cr_groups[0]);
991 		setsugid(p);
992 	}
993 	proc_set_cred(p, newcred);
994 	PROC_UNLOCK(p);
995 	crfree(oldcred);
996 	return (0);
997 
998 fail:
999 	PROC_UNLOCK(p);
1000 	crfree(newcred);
1001 	return (error);
1002 }
1003 
1004 /*
1005  * setresuid(ruid, euid, suid) is like setreuid except control over the saved
1006  * uid is explicit.
1007  */
1008 #ifndef _SYS_SYSPROTO_H_
1009 struct setresuid_args {
1010 	uid_t	ruid;
1011 	uid_t	euid;
1012 	uid_t	suid;
1013 };
1014 #endif
1015 /* ARGSUSED */
1016 int
1017 sys_setresuid(struct thread *td, struct setresuid_args *uap)
1018 {
1019 	struct proc *p = td->td_proc;
1020 	struct ucred *newcred, *oldcred;
1021 	uid_t euid, ruid, suid;
1022 	struct uidinfo *euip, *ruip;
1023 	int error;
1024 
1025 	euid = uap->euid;
1026 	ruid = uap->ruid;
1027 	suid = uap->suid;
1028 	AUDIT_ARG_EUID(euid);
1029 	AUDIT_ARG_RUID(ruid);
1030 	AUDIT_ARG_SUID(suid);
1031 	newcred = crget();
1032 	euip = uifind(euid);
1033 	ruip = uifind(ruid);
1034 	PROC_LOCK(p);
1035 	oldcred = crcopysafe(p, newcred);
1036 
1037 #ifdef MAC
1038 	error = mac_cred_check_setresuid(oldcred, ruid, euid, suid);
1039 	if (error)
1040 		goto fail;
1041 #endif
1042 
1043 	if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid &&
1044 	     ruid != oldcred->cr_svuid &&
1045 	      ruid != oldcred->cr_uid) ||
1046 	     (euid != (uid_t)-1 && euid != oldcred->cr_ruid &&
1047 	    euid != oldcred->cr_svuid &&
1048 	      euid != oldcred->cr_uid) ||
1049 	     (suid != (uid_t)-1 && suid != oldcred->cr_ruid &&
1050 	    suid != oldcred->cr_svuid &&
1051 	      suid != oldcred->cr_uid)) &&
1052 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETRESUID, 0)) != 0)
1053 		goto fail;
1054 
1055 	if (euid != (uid_t)-1 && oldcred->cr_uid != euid) {
1056 		change_euid(newcred, euip);
1057 		setsugid(p);
1058 	}
1059 	if (ruid != (uid_t)-1 && oldcred->cr_ruid != ruid) {
1060 		change_ruid(newcred, ruip);
1061 		setsugid(p);
1062 	}
1063 	if (suid != (uid_t)-1 && oldcred->cr_svuid != suid) {
1064 		change_svuid(newcred, suid);
1065 		setsugid(p);
1066 	}
1067 	proc_set_cred(p, newcred);
1068 	PROC_UNLOCK(p);
1069 #ifdef RACCT
1070 	racct_proc_ucred_changed(p, oldcred, newcred);
1071 #endif
1072 	uifree(ruip);
1073 	uifree(euip);
1074 	crfree(oldcred);
1075 	return (0);
1076 
1077 fail:
1078 	PROC_UNLOCK(p);
1079 	uifree(ruip);
1080 	uifree(euip);
1081 	crfree(newcred);
1082 	return (error);
1083 
1084 }
1085 
1086 /*
1087  * setresgid(rgid, egid, sgid) is like setregid except control over the saved
1088  * gid is explicit.
1089  */
1090 #ifndef _SYS_SYSPROTO_H_
1091 struct setresgid_args {
1092 	gid_t	rgid;
1093 	gid_t	egid;
1094 	gid_t	sgid;
1095 };
1096 #endif
1097 /* ARGSUSED */
1098 int
1099 sys_setresgid(struct thread *td, struct setresgid_args *uap)
1100 {
1101 	struct proc *p = td->td_proc;
1102 	struct ucred *newcred, *oldcred;
1103 	gid_t egid, rgid, sgid;
1104 	int error;
1105 
1106 	egid = uap->egid;
1107 	rgid = uap->rgid;
1108 	sgid = uap->sgid;
1109 	AUDIT_ARG_EGID(egid);
1110 	AUDIT_ARG_RGID(rgid);
1111 	AUDIT_ARG_SGID(sgid);
1112 	newcred = crget();
1113 	PROC_LOCK(p);
1114 	oldcred = crcopysafe(p, newcred);
1115 
1116 #ifdef MAC
1117 	error = mac_cred_check_setresgid(oldcred, rgid, egid, sgid);
1118 	if (error)
1119 		goto fail;
1120 #endif
1121 
1122 	if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid &&
1123 	      rgid != oldcred->cr_svgid &&
1124 	      rgid != oldcred->cr_groups[0]) ||
1125 	     (egid != (gid_t)-1 && egid != oldcred->cr_rgid &&
1126 	      egid != oldcred->cr_svgid &&
1127 	      egid != oldcred->cr_groups[0]) ||
1128 	     (sgid != (gid_t)-1 && sgid != oldcred->cr_rgid &&
1129 	      sgid != oldcred->cr_svgid &&
1130 	      sgid != oldcred->cr_groups[0])) &&
1131 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETRESGID, 0)) != 0)
1132 		goto fail;
1133 
1134 	if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) {
1135 		change_egid(newcred, egid);
1136 		setsugid(p);
1137 	}
1138 	if (rgid != (gid_t)-1 && oldcred->cr_rgid != rgid) {
1139 		change_rgid(newcred, rgid);
1140 		setsugid(p);
1141 	}
1142 	if (sgid != (gid_t)-1 && oldcred->cr_svgid != sgid) {
1143 		change_svgid(newcred, sgid);
1144 		setsugid(p);
1145 	}
1146 	proc_set_cred(p, newcred);
1147 	PROC_UNLOCK(p);
1148 	crfree(oldcred);
1149 	return (0);
1150 
1151 fail:
1152 	PROC_UNLOCK(p);
1153 	crfree(newcred);
1154 	return (error);
1155 }
1156 
1157 #ifndef _SYS_SYSPROTO_H_
1158 struct getresuid_args {
1159 	uid_t	*ruid;
1160 	uid_t	*euid;
1161 	uid_t	*suid;
1162 };
1163 #endif
1164 /* ARGSUSED */
1165 int
1166 sys_getresuid(struct thread *td, struct getresuid_args *uap)
1167 {
1168 	struct ucred *cred;
1169 	int error1 = 0, error2 = 0, error3 = 0;
1170 
1171 	cred = td->td_ucred;
1172 	if (uap->ruid)
1173 		error1 = copyout(&cred->cr_ruid,
1174 		    uap->ruid, sizeof(cred->cr_ruid));
1175 	if (uap->euid)
1176 		error2 = copyout(&cred->cr_uid,
1177 		    uap->euid, sizeof(cred->cr_uid));
1178 	if (uap->suid)
1179 		error3 = copyout(&cred->cr_svuid,
1180 		    uap->suid, sizeof(cred->cr_svuid));
1181 	return (error1 ? error1 : error2 ? error2 : error3);
1182 }
1183 
1184 #ifndef _SYS_SYSPROTO_H_
1185 struct getresgid_args {
1186 	gid_t	*rgid;
1187 	gid_t	*egid;
1188 	gid_t	*sgid;
1189 };
1190 #endif
1191 /* ARGSUSED */
1192 int
1193 sys_getresgid(struct thread *td, struct getresgid_args *uap)
1194 {
1195 	struct ucred *cred;
1196 	int error1 = 0, error2 = 0, error3 = 0;
1197 
1198 	cred = td->td_ucred;
1199 	if (uap->rgid)
1200 		error1 = copyout(&cred->cr_rgid,
1201 		    uap->rgid, sizeof(cred->cr_rgid));
1202 	if (uap->egid)
1203 		error2 = copyout(&cred->cr_groups[0],
1204 		    uap->egid, sizeof(cred->cr_groups[0]));
1205 	if (uap->sgid)
1206 		error3 = copyout(&cred->cr_svgid,
1207 		    uap->sgid, sizeof(cred->cr_svgid));
1208 	return (error1 ? error1 : error2 ? error2 : error3);
1209 }
1210 
1211 #ifndef _SYS_SYSPROTO_H_
1212 struct issetugid_args {
1213 	int dummy;
1214 };
1215 #endif
1216 /* ARGSUSED */
1217 int
1218 sys_issetugid(struct thread *td, struct issetugid_args *uap)
1219 {
1220 	struct proc *p = td->td_proc;
1221 
1222 	/*
1223 	 * Note: OpenBSD sets a P_SUGIDEXEC flag set at execve() time,
1224 	 * we use P_SUGID because we consider changing the owners as
1225 	 * "tainting" as well.
1226 	 * This is significant for procs that start as root and "become"
1227 	 * a user without an exec - programs cannot know *everything*
1228 	 * that libc *might* have put in their data segment.
1229 	 */
1230 	td->td_retval[0] = (p->p_flag & P_SUGID) ? 1 : 0;
1231 	return (0);
1232 }
1233 
1234 int
1235 sys___setugid(struct thread *td, struct __setugid_args *uap)
1236 {
1237 #ifdef REGRESSION
1238 	struct proc *p;
1239 
1240 	p = td->td_proc;
1241 	switch (uap->flag) {
1242 	case 0:
1243 		PROC_LOCK(p);
1244 		p->p_flag &= ~P_SUGID;
1245 		PROC_UNLOCK(p);
1246 		return (0);
1247 	case 1:
1248 		PROC_LOCK(p);
1249 		p->p_flag |= P_SUGID;
1250 		PROC_UNLOCK(p);
1251 		return (0);
1252 	default:
1253 		return (EINVAL);
1254 	}
1255 #else /* !REGRESSION */
1256 
1257 	return (ENOSYS);
1258 #endif /* REGRESSION */
1259 }
1260 
1261 /*
1262  * Check if gid is a member of the group set.
1263  */
1264 int
1265 groupmember(gid_t gid, struct ucred *cred)
1266 {
1267 	int l;
1268 	int h;
1269 	int m;
1270 
1271 	if (cred->cr_groups[0] == gid)
1272 		return(1);
1273 
1274 	/*
1275 	 * If gid was not our primary group, perform a binary search
1276 	 * of the supplemental groups.  This is possible because we
1277 	 * sort the groups in crsetgroups().
1278 	 */
1279 	l = 1;
1280 	h = cred->cr_ngroups;
1281 	while (l < h) {
1282 		m = l + ((h - l) / 2);
1283 		if (cred->cr_groups[m] < gid)
1284 			l = m + 1;
1285 		else
1286 			h = m;
1287 	}
1288 	if ((l < cred->cr_ngroups) && (cred->cr_groups[l] == gid))
1289 		return (1);
1290 
1291 	return (0);
1292 }
1293 
1294 /*
1295  * Test the active securelevel against a given level.  securelevel_gt()
1296  * implements (securelevel > level).  securelevel_ge() implements
1297  * (securelevel >= level).  Note that the logic is inverted -- these
1298  * functions return EPERM on "success" and 0 on "failure".
1299  *
1300  * Due to care taken when setting the securelevel, we know that no jail will
1301  * be less secure that its parent (or the physical system), so it is sufficient
1302  * to test the current jail only.
1303  *
1304  * XXXRW: Possibly since this has to do with privilege, it should move to
1305  * kern_priv.c.
1306  */
1307 int
1308 securelevel_gt(struct ucred *cr, int level)
1309 {
1310 
1311 	return (cr->cr_prison->pr_securelevel > level ? EPERM : 0);
1312 }
1313 
1314 int
1315 securelevel_ge(struct ucred *cr, int level)
1316 {
1317 
1318 	return (cr->cr_prison->pr_securelevel >= level ? EPERM : 0);
1319 }
1320 
1321 /*
1322  * 'see_other_uids' determines whether or not visibility of processes
1323  * and sockets with credentials holding different real uids is possible
1324  * using a variety of system MIBs.
1325  * XXX: data declarations should be together near the beginning of the file.
1326  */
1327 static int	see_other_uids = 1;
1328 SYSCTL_INT(_security_bsd, OID_AUTO, see_other_uids, CTLFLAG_RW,
1329     &see_other_uids, 0,
1330     "Unprivileged processes may see subjects/objects with different real uid");
1331 
1332 /*-
1333  * Determine if u1 "can see" the subject specified by u2, according to the
1334  * 'see_other_uids' policy.
1335  * Returns: 0 for permitted, ESRCH otherwise
1336  * Locks: none
1337  * References: *u1 and *u2 must not change during the call
1338  *             u1 may equal u2, in which case only one reference is required
1339  */
1340 int
1341 cr_canseeotheruids(struct ucred *u1, struct ucred *u2)
1342 {
1343 
1344 	if (!see_other_uids && u1->cr_ruid != u2->cr_ruid) {
1345 		if (priv_check_cred(u1, PRIV_SEEOTHERUIDS, 0) != 0)
1346 			return (ESRCH);
1347 	}
1348 	return (0);
1349 }
1350 
1351 /*
1352  * 'see_other_gids' determines whether or not visibility of processes
1353  * and sockets with credentials holding different real gids is possible
1354  * using a variety of system MIBs.
1355  * XXX: data declarations should be together near the beginning of the file.
1356  */
1357 static int	see_other_gids = 1;
1358 SYSCTL_INT(_security_bsd, OID_AUTO, see_other_gids, CTLFLAG_RW,
1359     &see_other_gids, 0,
1360     "Unprivileged processes may see subjects/objects with different real gid");
1361 
1362 /*
1363  * Determine if u1 can "see" the subject specified by u2, according to the
1364  * 'see_other_gids' policy.
1365  * Returns: 0 for permitted, ESRCH otherwise
1366  * Locks: none
1367  * References: *u1 and *u2 must not change during the call
1368  *             u1 may equal u2, in which case only one reference is required
1369  */
1370 int
1371 cr_canseeothergids(struct ucred *u1, struct ucred *u2)
1372 {
1373 	int i, match;
1374 
1375 	if (!see_other_gids) {
1376 		match = 0;
1377 		for (i = 0; i < u1->cr_ngroups; i++) {
1378 			if (groupmember(u1->cr_groups[i], u2))
1379 				match = 1;
1380 			if (match)
1381 				break;
1382 		}
1383 		if (!match) {
1384 			if (priv_check_cred(u1, PRIV_SEEOTHERGIDS, 0) != 0)
1385 				return (ESRCH);
1386 		}
1387 	}
1388 	return (0);
1389 }
1390 
1391 /*
1392  * 'see_jail_proc' determines whether or not visibility of processes and
1393  * sockets with credentials holding different jail ids is possible using a
1394  * variety of system MIBs.
1395  *
1396  * XXX: data declarations should be together near the beginning of the file.
1397  */
1398 
1399 static int	see_jail_proc = 1;
1400 SYSCTL_INT(_security_bsd, OID_AUTO, see_jail_proc, CTLFLAG_RW,
1401     &see_jail_proc, 0,
1402     "Unprivileged processes may see subjects/objects with different jail ids");
1403 
1404 /*-
1405  * Determine if u1 "can see" the subject specified by u2, according to the
1406  * 'see_jail_proc' policy.
1407  * Returns: 0 for permitted, ESRCH otherwise
1408  * Locks: none
1409  * References: *u1 and *u2 must not change during the call
1410  *             u1 may equal u2, in which case only one reference is required
1411  */
1412 int
1413 cr_canseejailproc(struct ucred *u1, struct ucred *u2)
1414 {
1415 	if (u1->cr_uid == 0)
1416 		return (0);
1417 	return (!see_jail_proc && u1->cr_prison != u2->cr_prison ? ESRCH : 0);
1418 }
1419 
1420 /*-
1421  * Determine if u1 "can see" the subject specified by u2.
1422  * Returns: 0 for permitted, an errno value otherwise
1423  * Locks: none
1424  * References: *u1 and *u2 must not change during the call
1425  *             u1 may equal u2, in which case only one reference is required
1426  */
1427 int
1428 cr_cansee(struct ucred *u1, struct ucred *u2)
1429 {
1430 	int error;
1431 
1432 	if ((error = prison_check(u1, u2)))
1433 		return (error);
1434 #ifdef MAC
1435 	if ((error = mac_cred_check_visible(u1, u2)))
1436 		return (error);
1437 #endif
1438 	if ((error = cr_canseeotheruids(u1, u2)))
1439 		return (error);
1440 	if ((error = cr_canseeothergids(u1, u2)))
1441 		return (error);
1442 	if ((error = cr_canseejailproc(u1, u2)))
1443 		return (error);
1444 	return (0);
1445 }
1446 
1447 /*-
1448  * Determine if td "can see" the subject specified by p.
1449  * Returns: 0 for permitted, an errno value otherwise
1450  * Locks: Sufficient locks to protect p->p_ucred must be held.  td really
1451  *        should be curthread.
1452  * References: td and p must be valid for the lifetime of the call
1453  */
1454 int
1455 p_cansee(struct thread *td, struct proc *p)
1456 {
1457 
1458 	/* Wrap cr_cansee() for all functionality. */
1459 	KASSERT(td == curthread, ("%s: td not curthread", __func__));
1460 	PROC_LOCK_ASSERT(p, MA_OWNED);
1461 	return (cr_cansee(td->td_ucred, p->p_ucred));
1462 }
1463 
1464 /*
1465  * 'conservative_signals' prevents the delivery of a broad class of
1466  * signals by unprivileged processes to processes that have changed their
1467  * credentials since the last invocation of execve().  This can prevent
1468  * the leakage of cached information or retained privileges as a result
1469  * of a common class of signal-related vulnerabilities.  However, this
1470  * may interfere with some applications that expect to be able to
1471  * deliver these signals to peer processes after having given up
1472  * privilege.
1473  */
1474 static int	conservative_signals = 1;
1475 SYSCTL_INT(_security_bsd, OID_AUTO, conservative_signals, CTLFLAG_RW,
1476     &conservative_signals, 0, "Unprivileged processes prevented from "
1477     "sending certain signals to processes whose credentials have changed");
1478 /*-
1479  * Determine whether cred may deliver the specified signal to proc.
1480  * Returns: 0 for permitted, an errno value otherwise.
1481  * Locks: A lock must be held for proc.
1482  * References: cred and proc must be valid for the lifetime of the call.
1483  */
1484 int
1485 cr_cansignal(struct ucred *cred, struct proc *proc, int signum)
1486 {
1487 	int error;
1488 
1489 	PROC_LOCK_ASSERT(proc, MA_OWNED);
1490 	/*
1491 	 * Jail semantics limit the scope of signalling to proc in the
1492 	 * same jail as cred, if cred is in jail.
1493 	 */
1494 	error = prison_check(cred, proc->p_ucred);
1495 	if (error)
1496 		return (error);
1497 #ifdef MAC
1498 	if ((error = mac_proc_check_signal(cred, proc, signum)))
1499 		return (error);
1500 #endif
1501 	if ((error = cr_canseeotheruids(cred, proc->p_ucred)))
1502 		return (error);
1503 	if ((error = cr_canseeothergids(cred, proc->p_ucred)))
1504 		return (error);
1505 
1506 	/*
1507 	 * UNIX signal semantics depend on the status of the P_SUGID
1508 	 * bit on the target process.  If the bit is set, then additional
1509 	 * restrictions are placed on the set of available signals.
1510 	 */
1511 	if (conservative_signals && (proc->p_flag & P_SUGID)) {
1512 		switch (signum) {
1513 		case 0:
1514 		case SIGKILL:
1515 		case SIGINT:
1516 		case SIGTERM:
1517 		case SIGALRM:
1518 		case SIGSTOP:
1519 		case SIGTTIN:
1520 		case SIGTTOU:
1521 		case SIGTSTP:
1522 		case SIGHUP:
1523 		case SIGUSR1:
1524 		case SIGUSR2:
1525 			/*
1526 			 * Generally, permit job and terminal control
1527 			 * signals.
1528 			 */
1529 			break;
1530 		default:
1531 			/* Not permitted without privilege. */
1532 			error = priv_check_cred(cred, PRIV_SIGNAL_SUGID, 0);
1533 			if (error)
1534 				return (error);
1535 		}
1536 	}
1537 
1538 	/*
1539 	 * Generally, the target credential's ruid or svuid must match the
1540 	 * subject credential's ruid or euid.
1541 	 */
1542 	if (cred->cr_ruid != proc->p_ucred->cr_ruid &&
1543 	    cred->cr_ruid != proc->p_ucred->cr_svuid &&
1544 	    cred->cr_uid != proc->p_ucred->cr_ruid &&
1545 	    cred->cr_uid != proc->p_ucred->cr_svuid) {
1546 		error = priv_check_cred(cred, PRIV_SIGNAL_DIFFCRED, 0);
1547 		if (error)
1548 			return (error);
1549 	}
1550 
1551 	return (0);
1552 }
1553 
1554 /*-
1555  * Determine whether td may deliver the specified signal to p.
1556  * Returns: 0 for permitted, an errno value otherwise
1557  * Locks: Sufficient locks to protect various components of td and p
1558  *        must be held.  td must be curthread, and a lock must be
1559  *        held for p.
1560  * References: td and p must be valid for the lifetime of the call
1561  */
1562 int
1563 p_cansignal(struct thread *td, struct proc *p, int signum)
1564 {
1565 
1566 	KASSERT(td == curthread, ("%s: td not curthread", __func__));
1567 	PROC_LOCK_ASSERT(p, MA_OWNED);
1568 	if (td->td_proc == p)
1569 		return (0);
1570 
1571 	/*
1572 	 * UNIX signalling semantics require that processes in the same
1573 	 * session always be able to deliver SIGCONT to one another,
1574 	 * overriding the remaining protections.
1575 	 */
1576 	/* XXX: This will require an additional lock of some sort. */
1577 	if (signum == SIGCONT && td->td_proc->p_session == p->p_session)
1578 		return (0);
1579 	/*
1580 	 * Some compat layers use SIGTHR and higher signals for
1581 	 * communication between different kernel threads of the same
1582 	 * process, so that they expect that it's always possible to
1583 	 * deliver them, even for suid applications where cr_cansignal() can
1584 	 * deny such ability for security consideration.  It should be
1585 	 * pretty safe to do since the only way to create two processes
1586 	 * with the same p_leader is via rfork(2).
1587 	 */
1588 	if (td->td_proc->p_leader != NULL && signum >= SIGTHR &&
1589 	    signum < SIGTHR + 4 && td->td_proc->p_leader == p->p_leader)
1590 		return (0);
1591 
1592 	return (cr_cansignal(td->td_ucred, p, signum));
1593 }
1594 
1595 /*-
1596  * Determine whether td may reschedule p.
1597  * Returns: 0 for permitted, an errno value otherwise
1598  * Locks: Sufficient locks to protect various components of td and p
1599  *        must be held.  td must be curthread, and a lock must
1600  *        be held for p.
1601  * References: td and p must be valid for the lifetime of the call
1602  */
1603 int
1604 p_cansched(struct thread *td, struct proc *p)
1605 {
1606 	int error;
1607 
1608 	KASSERT(td == curthread, ("%s: td not curthread", __func__));
1609 	PROC_LOCK_ASSERT(p, MA_OWNED);
1610 	if (td->td_proc == p)
1611 		return (0);
1612 	if ((error = prison_check(td->td_ucred, p->p_ucred)))
1613 		return (error);
1614 #ifdef MAC
1615 	if ((error = mac_proc_check_sched(td->td_ucred, p)))
1616 		return (error);
1617 #endif
1618 	if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred)))
1619 		return (error);
1620 	if ((error = cr_canseeothergids(td->td_ucred, p->p_ucred)))
1621 		return (error);
1622 	if (td->td_ucred->cr_ruid != p->p_ucred->cr_ruid &&
1623 	    td->td_ucred->cr_uid != p->p_ucred->cr_ruid) {
1624 		error = priv_check(td, PRIV_SCHED_DIFFCRED);
1625 		if (error)
1626 			return (error);
1627 	}
1628 	return (0);
1629 }
1630 
1631 /*
1632  * The 'unprivileged_proc_debug' flag may be used to disable a variety of
1633  * unprivileged inter-process debugging services, including some procfs
1634  * functionality, ptrace(), and ktrace().  In the past, inter-process
1635  * debugging has been involved in a variety of security problems, and sites
1636  * not requiring the service might choose to disable it when hardening
1637  * systems.
1638  *
1639  * XXX: Should modifying and reading this variable require locking?
1640  * XXX: data declarations should be together near the beginning of the file.
1641  */
1642 static int	unprivileged_proc_debug = 1;
1643 SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_proc_debug, CTLFLAG_RW,
1644     &unprivileged_proc_debug, 0,
1645     "Unprivileged processes may use process debugging facilities");
1646 
1647 /*-
1648  * Determine whether td may debug p.
1649  * Returns: 0 for permitted, an errno value otherwise
1650  * Locks: Sufficient locks to protect various components of td and p
1651  *        must be held.  td must be curthread, and a lock must
1652  *        be held for p.
1653  * References: td and p must be valid for the lifetime of the call
1654  */
1655 int
1656 p_candebug(struct thread *td, struct proc *p)
1657 {
1658 	int credentialchanged, error, grpsubset, i, uidsubset;
1659 
1660 	KASSERT(td == curthread, ("%s: td not curthread", __func__));
1661 	PROC_LOCK_ASSERT(p, MA_OWNED);
1662 	if (!unprivileged_proc_debug) {
1663 		error = priv_check(td, PRIV_DEBUG_UNPRIV);
1664 		if (error)
1665 			return (error);
1666 	}
1667 	if (td->td_proc == p)
1668 		return (0);
1669 	if ((error = prison_check(td->td_ucred, p->p_ucred)))
1670 		return (error);
1671 #ifdef MAC
1672 	if ((error = mac_proc_check_debug(td->td_ucred, p)))
1673 		return (error);
1674 #endif
1675 	if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred)))
1676 		return (error);
1677 	if ((error = cr_canseeothergids(td->td_ucred, p->p_ucred)))
1678 		return (error);
1679 
1680 	/*
1681 	 * Is p's group set a subset of td's effective group set?  This
1682 	 * includes p's egid, group access list, rgid, and svgid.
1683 	 */
1684 	grpsubset = 1;
1685 	for (i = 0; i < p->p_ucred->cr_ngroups; i++) {
1686 		if (!groupmember(p->p_ucred->cr_groups[i], td->td_ucred)) {
1687 			grpsubset = 0;
1688 			break;
1689 		}
1690 	}
1691 	grpsubset = grpsubset &&
1692 	    groupmember(p->p_ucred->cr_rgid, td->td_ucred) &&
1693 	    groupmember(p->p_ucred->cr_svgid, td->td_ucred);
1694 
1695 	/*
1696 	 * Are the uids present in p's credential equal to td's
1697 	 * effective uid?  This includes p's euid, svuid, and ruid.
1698 	 */
1699 	uidsubset = (td->td_ucred->cr_uid == p->p_ucred->cr_uid &&
1700 	    td->td_ucred->cr_uid == p->p_ucred->cr_svuid &&
1701 	    td->td_ucred->cr_uid == p->p_ucred->cr_ruid);
1702 
1703 	/*
1704 	 * Has the credential of the process changed since the last exec()?
1705 	 */
1706 	credentialchanged = (p->p_flag & P_SUGID);
1707 
1708 	/*
1709 	 * If p's gids aren't a subset, or the uids aren't a subset,
1710 	 * or the credential has changed, require appropriate privilege
1711 	 * for td to debug p.
1712 	 */
1713 	if (!grpsubset || !uidsubset) {
1714 		error = priv_check(td, PRIV_DEBUG_DIFFCRED);
1715 		if (error)
1716 			return (error);
1717 	}
1718 
1719 	if (credentialchanged) {
1720 		error = priv_check(td, PRIV_DEBUG_SUGID);
1721 		if (error)
1722 			return (error);
1723 	}
1724 
1725 	/* Can't trace init when securelevel > 0. */
1726 	if (p == initproc) {
1727 		error = securelevel_gt(td->td_ucred, 0);
1728 		if (error)
1729 			return (error);
1730 	}
1731 
1732 	/*
1733 	 * Can't trace a process that's currently exec'ing.
1734 	 *
1735 	 * XXX: Note, this is not a security policy decision, it's a
1736 	 * basic correctness/functionality decision.  Therefore, this check
1737 	 * should be moved to the caller's of p_candebug().
1738 	 */
1739 	if ((p->p_flag & P_INEXEC) != 0)
1740 		return (EBUSY);
1741 
1742 	/* Denied explicitely */
1743 	if ((p->p_flag2 & P2_NOTRACE) != 0) {
1744 		error = priv_check(td, PRIV_DEBUG_DENIED);
1745 		if (error != 0)
1746 			return (error);
1747 	}
1748 
1749 	return (0);
1750 }
1751 
1752 /*-
1753  * Determine whether the subject represented by cred can "see" a socket.
1754  * Returns: 0 for permitted, ENOENT otherwise.
1755  */
1756 int
1757 cr_canseesocket(struct ucred *cred, struct socket *so)
1758 {
1759 	int error;
1760 
1761 	error = prison_check(cred, so->so_cred);
1762 	if (error)
1763 		return (ENOENT);
1764 #ifdef MAC
1765 	error = mac_socket_check_visible(cred, so);
1766 	if (error)
1767 		return (error);
1768 #endif
1769 	if (cr_canseeotheruids(cred, so->so_cred))
1770 		return (ENOENT);
1771 	if (cr_canseeothergids(cred, so->so_cred))
1772 		return (ENOENT);
1773 
1774 	return (0);
1775 }
1776 
1777 /*-
1778  * Determine whether td can wait for the exit of p.
1779  * Returns: 0 for permitted, an errno value otherwise
1780  * Locks: Sufficient locks to protect various components of td and p
1781  *        must be held.  td must be curthread, and a lock must
1782  *        be held for p.
1783  * References: td and p must be valid for the lifetime of the call
1784 
1785  */
1786 int
1787 p_canwait(struct thread *td, struct proc *p)
1788 {
1789 	int error;
1790 
1791 	KASSERT(td == curthread, ("%s: td not curthread", __func__));
1792 	PROC_LOCK_ASSERT(p, MA_OWNED);
1793 	if ((error = prison_check(td->td_ucred, p->p_ucred)))
1794 		return (error);
1795 #ifdef MAC
1796 	if ((error = mac_proc_check_wait(td->td_ucred, p)))
1797 		return (error);
1798 #endif
1799 #if 0
1800 	/* XXXMAC: This could have odd effects on some shells. */
1801 	if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred)))
1802 		return (error);
1803 #endif
1804 
1805 	return (0);
1806 }
1807 
1808 /*
1809  * Allocate a zeroed cred structure.
1810  */
1811 struct ucred *
1812 crget(void)
1813 {
1814 	struct ucred *cr;
1815 
1816 	cr = malloc(sizeof(*cr), M_CRED, M_WAITOK | M_ZERO);
1817 	refcount_init(&cr->cr_ref, 1);
1818 #ifdef AUDIT
1819 	audit_cred_init(cr);
1820 #endif
1821 #ifdef MAC
1822 	mac_cred_init(cr);
1823 #endif
1824 	cr->cr_groups = cr->cr_smallgroups;
1825 	cr->cr_agroups =
1826 	    sizeof(cr->cr_smallgroups) / sizeof(cr->cr_smallgroups[0]);
1827 	return (cr);
1828 }
1829 
1830 /*
1831  * Claim another reference to a ucred structure.
1832  */
1833 struct ucred *
1834 crhold(struct ucred *cr)
1835 {
1836 
1837 	refcount_acquire(&cr->cr_ref);
1838 	return (cr);
1839 }
1840 
1841 /*
1842  * Free a cred structure.  Throws away space when ref count gets to 0.
1843  */
1844 void
1845 crfree(struct ucred *cr)
1846 {
1847 
1848 	KASSERT(cr->cr_ref > 0, ("bad ucred refcount: %d", cr->cr_ref));
1849 	KASSERT(cr->cr_ref != 0xdeadc0de, ("dangling reference to ucred"));
1850 	if (refcount_release(&cr->cr_ref)) {
1851 		/*
1852 		 * Some callers of crget(), such as nfs_statfs(),
1853 		 * allocate a temporary credential, but don't
1854 		 * allocate a uidinfo structure.
1855 		 */
1856 		if (cr->cr_uidinfo != NULL)
1857 			uifree(cr->cr_uidinfo);
1858 		if (cr->cr_ruidinfo != NULL)
1859 			uifree(cr->cr_ruidinfo);
1860 		/*
1861 		 * Free a prison, if any.
1862 		 */
1863 		if (cr->cr_prison != NULL)
1864 			prison_free(cr->cr_prison);
1865 		if (cr->cr_loginclass != NULL)
1866 			loginclass_free(cr->cr_loginclass);
1867 #ifdef AUDIT
1868 		audit_cred_destroy(cr);
1869 #endif
1870 #ifdef MAC
1871 		mac_cred_destroy(cr);
1872 #endif
1873 		if (cr->cr_groups != cr->cr_smallgroups)
1874 			free(cr->cr_groups, M_CRED);
1875 		free(cr, M_CRED);
1876 	}
1877 }
1878 
1879 /*
1880  * Copy a ucred's contents from a template.  Does not block.
1881  */
1882 void
1883 crcopy(struct ucred *dest, struct ucred *src)
1884 {
1885 
1886 	KASSERT(dest->cr_ref == 1, ("crcopy of shared ucred"));
1887 	bcopy(&src->cr_startcopy, &dest->cr_startcopy,
1888 	    (unsigned)((caddr_t)&src->cr_endcopy -
1889 		(caddr_t)&src->cr_startcopy));
1890 	crsetgroups(dest, src->cr_ngroups, src->cr_groups);
1891 	uihold(dest->cr_uidinfo);
1892 	uihold(dest->cr_ruidinfo);
1893 	prison_hold(dest->cr_prison);
1894 	loginclass_hold(dest->cr_loginclass);
1895 #ifdef AUDIT
1896 	audit_cred_copy(src, dest);
1897 #endif
1898 #ifdef MAC
1899 	mac_cred_copy(src, dest);
1900 #endif
1901 }
1902 
1903 /*
1904  * Dup cred struct to a new held one.
1905  */
1906 struct ucred *
1907 crdup(struct ucred *cr)
1908 {
1909 	struct ucred *newcr;
1910 
1911 	newcr = crget();
1912 	crcopy(newcr, cr);
1913 	return (newcr);
1914 }
1915 
1916 /*
1917  * Fill in a struct xucred based on a struct ucred.
1918  */
1919 void
1920 cru2x(struct ucred *cr, struct xucred *xcr)
1921 {
1922 	int ngroups;
1923 
1924 	bzero(xcr, sizeof(*xcr));
1925 	xcr->cr_version = XUCRED_VERSION;
1926 	xcr->cr_uid = cr->cr_uid;
1927 
1928 	ngroups = MIN(cr->cr_ngroups, XU_NGROUPS);
1929 	xcr->cr_ngroups = ngroups;
1930 	bcopy(cr->cr_groups, xcr->cr_groups,
1931 	    ngroups * sizeof(*cr->cr_groups));
1932 }
1933 
1934 /*
1935  * Set initial process credentials.
1936  * Callers are responsible for providing the reference for provided credentials.
1937  */
1938 void
1939 proc_set_cred_init(struct proc *p, struct ucred *newcred)
1940 {
1941 
1942 	p->p_ucred = newcred;
1943 }
1944 
1945 /*
1946  * Change process credentials.
1947  * Callers are responsible for providing the reference for passed credentials
1948  * and for freeing old ones.
1949  *
1950  * Process has to be locked except when it does not have credentials (as it
1951  * should not be visible just yet) or when newcred is NULL (as this can be
1952  * only used when the process is about to be freed, at which point it should
1953  * not be visible anymore).
1954  */
1955 struct ucred *
1956 proc_set_cred(struct proc *p, struct ucred *newcred)
1957 {
1958 	struct ucred *oldcred;
1959 
1960 	MPASS(p->p_ucred != NULL);
1961 	if (newcred == NULL)
1962 		MPASS(p->p_state == PRS_ZOMBIE);
1963 	else
1964 		PROC_LOCK_ASSERT(p, MA_OWNED);
1965 
1966 	oldcred = p->p_ucred;
1967 	p->p_ucred = newcred;
1968 	if (newcred != NULL)
1969 		PROC_UPDATE_COW(p);
1970 	return (oldcred);
1971 }
1972 
1973 struct ucred *
1974 crcopysafe(struct proc *p, struct ucred *cr)
1975 {
1976 	struct ucred *oldcred;
1977 	int groups;
1978 
1979 	PROC_LOCK_ASSERT(p, MA_OWNED);
1980 
1981 	oldcred = p->p_ucred;
1982 	while (cr->cr_agroups < oldcred->cr_agroups) {
1983 		groups = oldcred->cr_agroups;
1984 		PROC_UNLOCK(p);
1985 		crextend(cr, groups);
1986 		PROC_LOCK(p);
1987 		oldcred = p->p_ucred;
1988 	}
1989 	crcopy(cr, oldcred);
1990 
1991 	return (oldcred);
1992 }
1993 
1994 /*
1995  * Extend the passed in credential to hold n items.
1996  */
1997 void
1998 crextend(struct ucred *cr, int n)
1999 {
2000 	int cnt;
2001 
2002 	/* Truncate? */
2003 	if (n <= cr->cr_agroups)
2004 		return;
2005 
2006 	/*
2007 	 * We extend by 2 each time since we're using a power of two
2008 	 * allocator until we need enough groups to fill a page.
2009 	 * Once we're allocating multiple pages, only allocate as many
2010 	 * as we actually need.  The case of processes needing a
2011 	 * non-power of two number of pages seems more likely than
2012 	 * a real world process that adds thousands of groups one at a
2013 	 * time.
2014 	 */
2015 	if ( n < PAGE_SIZE / sizeof(gid_t) ) {
2016 		if (cr->cr_agroups == 0)
2017 			cnt = MINALLOCSIZE / sizeof(gid_t);
2018 		else
2019 			cnt = cr->cr_agroups * 2;
2020 
2021 		while (cnt < n)
2022 			cnt *= 2;
2023 	} else
2024 		cnt = roundup2(n, PAGE_SIZE / sizeof(gid_t));
2025 
2026 	/* Free the old array. */
2027 	if (cr->cr_groups != cr->cr_smallgroups)
2028 		free(cr->cr_groups, M_CRED);
2029 
2030 	cr->cr_groups = malloc(cnt * sizeof(gid_t), M_CRED, M_WAITOK | M_ZERO);
2031 	cr->cr_agroups = cnt;
2032 }
2033 
2034 /*
2035  * Copy groups in to a credential, preserving any necessary invariants.
2036  * Currently this includes the sorting of all supplemental gids.
2037  * crextend() must have been called before hand to ensure sufficient
2038  * space is available.
2039  */
2040 static void
2041 crsetgroups_locked(struct ucred *cr, int ngrp, gid_t *groups)
2042 {
2043 	int i;
2044 	int j;
2045 	gid_t g;
2046 
2047 	KASSERT(cr->cr_agroups >= ngrp, ("cr_ngroups is too small"));
2048 
2049 	bcopy(groups, cr->cr_groups, ngrp * sizeof(gid_t));
2050 	cr->cr_ngroups = ngrp;
2051 
2052 	/*
2053 	 * Sort all groups except cr_groups[0] to allow groupmember to
2054 	 * perform a binary search.
2055 	 *
2056 	 * XXX: If large numbers of groups become common this should
2057 	 * be replaced with shell sort like linux uses or possibly
2058 	 * heap sort.
2059 	 */
2060 	for (i = 2; i < ngrp; i++) {
2061 		g = cr->cr_groups[i];
2062 		for (j = i-1; j >= 1 && g < cr->cr_groups[j]; j--)
2063 			cr->cr_groups[j + 1] = cr->cr_groups[j];
2064 		cr->cr_groups[j + 1] = g;
2065 	}
2066 }
2067 
2068 /*
2069  * Copy groups in to a credential after expanding it if required.
2070  * Truncate the list to (ngroups_max + 1) if it is too large.
2071  */
2072 void
2073 crsetgroups(struct ucred *cr, int ngrp, gid_t *groups)
2074 {
2075 
2076 	if (ngrp > ngroups_max + 1)
2077 		ngrp = ngroups_max + 1;
2078 
2079 	crextend(cr, ngrp);
2080 	crsetgroups_locked(cr, ngrp, groups);
2081 }
2082 
2083 /*
2084  * Get login name, if available.
2085  */
2086 #ifndef _SYS_SYSPROTO_H_
2087 struct getlogin_args {
2088 	char	*namebuf;
2089 	u_int	namelen;
2090 };
2091 #endif
2092 /* ARGSUSED */
2093 int
2094 sys_getlogin(struct thread *td, struct getlogin_args *uap)
2095 {
2096 	char login[MAXLOGNAME];
2097 	struct proc *p = td->td_proc;
2098 	size_t len;
2099 
2100 	if (uap->namelen > MAXLOGNAME)
2101 		uap->namelen = MAXLOGNAME;
2102 	PROC_LOCK(p);
2103 	SESS_LOCK(p->p_session);
2104 	len = strlcpy(login, p->p_session->s_login, uap->namelen) + 1;
2105 	SESS_UNLOCK(p->p_session);
2106 	PROC_UNLOCK(p);
2107 	if (len > uap->namelen)
2108 		return (ERANGE);
2109 	return (copyout(login, uap->namebuf, len));
2110 }
2111 
2112 /*
2113  * Set login name.
2114  */
2115 #ifndef _SYS_SYSPROTO_H_
2116 struct setlogin_args {
2117 	char	*namebuf;
2118 };
2119 #endif
2120 /* ARGSUSED */
2121 int
2122 sys_setlogin(struct thread *td, struct setlogin_args *uap)
2123 {
2124 	struct proc *p = td->td_proc;
2125 	int error;
2126 	char logintmp[MAXLOGNAME];
2127 
2128 	CTASSERT(sizeof(p->p_session->s_login) >= sizeof(logintmp));
2129 
2130 	error = priv_check(td, PRIV_PROC_SETLOGIN);
2131 	if (error)
2132 		return (error);
2133 	error = copyinstr(uap->namebuf, logintmp, sizeof(logintmp), NULL);
2134 	if (error != 0) {
2135 		if (error == ENAMETOOLONG)
2136 			error = EINVAL;
2137 		return (error);
2138 	}
2139 	AUDIT_ARG_LOGIN(logintmp);
2140 	PROC_LOCK(p);
2141 	SESS_LOCK(p->p_session);
2142 	strcpy(p->p_session->s_login, logintmp);
2143 	SESS_UNLOCK(p->p_session);
2144 	PROC_UNLOCK(p);
2145 	return (0);
2146 }
2147 
2148 void
2149 setsugid(struct proc *p)
2150 {
2151 
2152 	PROC_LOCK_ASSERT(p, MA_OWNED);
2153 	p->p_flag |= P_SUGID;
2154 	if (!(p->p_pfsflags & PF_ISUGID))
2155 		p->p_stops = 0;
2156 }
2157 
2158 /*-
2159  * Change a process's effective uid.
2160  * Side effects: newcred->cr_uid and newcred->cr_uidinfo will be modified.
2161  * References: newcred must be an exclusive credential reference for the
2162  *             duration of the call.
2163  */
2164 void
2165 change_euid(struct ucred *newcred, struct uidinfo *euip)
2166 {
2167 
2168 	newcred->cr_uid = euip->ui_uid;
2169 	uihold(euip);
2170 	uifree(newcred->cr_uidinfo);
2171 	newcred->cr_uidinfo = euip;
2172 }
2173 
2174 /*-
2175  * Change a process's effective gid.
2176  * Side effects: newcred->cr_gid will be modified.
2177  * References: newcred must be an exclusive credential reference for the
2178  *             duration of the call.
2179  */
2180 void
2181 change_egid(struct ucred *newcred, gid_t egid)
2182 {
2183 
2184 	newcred->cr_groups[0] = egid;
2185 }
2186 
2187 /*-
2188  * Change a process's real uid.
2189  * Side effects: newcred->cr_ruid will be updated, newcred->cr_ruidinfo
2190  *               will be updated, and the old and new cr_ruidinfo proc
2191  *               counts will be updated.
2192  * References: newcred must be an exclusive credential reference for the
2193  *             duration of the call.
2194  */
2195 void
2196 change_ruid(struct ucred *newcred, struct uidinfo *ruip)
2197 {
2198 
2199 	(void)chgproccnt(newcred->cr_ruidinfo, -1, 0);
2200 	newcred->cr_ruid = ruip->ui_uid;
2201 	uihold(ruip);
2202 	uifree(newcred->cr_ruidinfo);
2203 	newcred->cr_ruidinfo = ruip;
2204 	(void)chgproccnt(newcred->cr_ruidinfo, 1, 0);
2205 }
2206 
2207 /*-
2208  * Change a process's real gid.
2209  * Side effects: newcred->cr_rgid will be updated.
2210  * References: newcred must be an exclusive credential reference for the
2211  *             duration of the call.
2212  */
2213 void
2214 change_rgid(struct ucred *newcred, gid_t rgid)
2215 {
2216 
2217 	newcred->cr_rgid = rgid;
2218 }
2219 
2220 /*-
2221  * Change a process's saved uid.
2222  * Side effects: newcred->cr_svuid will be updated.
2223  * References: newcred must be an exclusive credential reference for the
2224  *             duration of the call.
2225  */
2226 void
2227 change_svuid(struct ucred *newcred, uid_t svuid)
2228 {
2229 
2230 	newcred->cr_svuid = svuid;
2231 }
2232 
2233 /*-
2234  * Change a process's saved gid.
2235  * Side effects: newcred->cr_svgid will be updated.
2236  * References: newcred must be an exclusive credential reference for the
2237  *             duration of the call.
2238  */
2239 void
2240 change_svgid(struct ucred *newcred, gid_t svgid)
2241 {
2242 
2243 	newcred->cr_svgid = svgid;
2244 }
2245