1 /*- 2 * Copyright (c) 1982, 1986, 1989, 1990, 1991, 1993 3 * The Regents of the University of California. 4 * (c) UNIX System Laboratories, Inc. 5 * Copyright (c) 2000-2001 Robert N. M. Watson. 6 * All rights reserved. 7 * 8 * All or some portions of this file are derived from material licensed 9 * to the University of California by American Telephone and Telegraph 10 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 11 * the permission of UNIX System Laboratories, Inc. 12 * 13 * Redistribution and use in source and binary forms, with or without 14 * modification, are permitted provided that the following conditions 15 * are met: 16 * 1. Redistributions of source code must retain the above copyright 17 * notice, this list of conditions and the following disclaimer. 18 * 2. Redistributions in binary form must reproduce the above copyright 19 * notice, this list of conditions and the following disclaimer in the 20 * documentation and/or other materials provided with the distribution. 21 * 3. Neither the name of the University nor the names of its contributors 22 * may be used to endorse or promote products derived from this software 23 * without specific prior written permission. 24 * 25 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 26 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 27 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 28 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 29 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 30 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 31 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 32 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 33 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 34 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 35 * SUCH DAMAGE. 36 * 37 * @(#)kern_prot.c 8.6 (Berkeley) 1/21/94 38 */ 39 40 /* 41 * System calls related to processes and protection 42 */ 43 44 #include <sys/cdefs.h> 45 __FBSDID("$FreeBSD$"); 46 47 #include "opt_compat.h" 48 #include "opt_inet.h" 49 #include "opt_inet6.h" 50 51 #include <sys/param.h> 52 #include <sys/systm.h> 53 #include <sys/acct.h> 54 #include <sys/kdb.h> 55 #include <sys/kernel.h> 56 #include <sys/lock.h> 57 #include <sys/loginclass.h> 58 #include <sys/malloc.h> 59 #include <sys/mutex.h> 60 #include <sys/refcount.h> 61 #include <sys/sx.h> 62 #include <sys/priv.h> 63 #include <sys/proc.h> 64 #include <sys/sysproto.h> 65 #include <sys/jail.h> 66 #include <sys/pioctl.h> 67 #include <sys/racct.h> 68 #include <sys/resourcevar.h> 69 #include <sys/socket.h> 70 #include <sys/socketvar.h> 71 #include <sys/syscallsubr.h> 72 #include <sys/sysctl.h> 73 74 #ifdef REGRESSION 75 FEATURE(regression, 76 "Kernel support for interfaces necessary for regression testing (SECURITY RISK!)"); 77 #endif 78 79 #include <security/audit/audit.h> 80 #include <security/mac/mac_framework.h> 81 82 static MALLOC_DEFINE(M_CRED, "cred", "credentials"); 83 84 SYSCTL_NODE(_security, OID_AUTO, bsd, CTLFLAG_RW, 0, "BSD security policy"); 85 86 static void crsetgroups_locked(struct ucred *cr, int ngrp, 87 gid_t *groups); 88 89 #ifndef _SYS_SYSPROTO_H_ 90 struct getpid_args { 91 int dummy; 92 }; 93 #endif 94 /* ARGSUSED */ 95 int 96 sys_getpid(struct thread *td, struct getpid_args *uap) 97 { 98 struct proc *p = td->td_proc; 99 100 td->td_retval[0] = p->p_pid; 101 #if defined(COMPAT_43) 102 td->td_retval[1] = kern_getppid(td); 103 #endif 104 return (0); 105 } 106 107 #ifndef _SYS_SYSPROTO_H_ 108 struct getppid_args { 109 int dummy; 110 }; 111 #endif 112 /* ARGSUSED */ 113 int 114 sys_getppid(struct thread *td, struct getppid_args *uap) 115 { 116 117 td->td_retval[0] = kern_getppid(td); 118 return (0); 119 } 120 121 int 122 kern_getppid(struct thread *td) 123 { 124 struct proc *p = td->td_proc; 125 struct proc *pp; 126 int ppid; 127 128 PROC_LOCK(p); 129 if (!(p->p_flag & P_TRACED)) { 130 ppid = p->p_pptr->p_pid; 131 PROC_UNLOCK(p); 132 } else { 133 PROC_UNLOCK(p); 134 sx_slock(&proctree_lock); 135 pp = proc_realparent(p); 136 ppid = pp->p_pid; 137 sx_sunlock(&proctree_lock); 138 } 139 140 return (ppid); 141 } 142 143 /* 144 * Get process group ID; note that POSIX getpgrp takes no parameter. 145 */ 146 #ifndef _SYS_SYSPROTO_H_ 147 struct getpgrp_args { 148 int dummy; 149 }; 150 #endif 151 int 152 sys_getpgrp(struct thread *td, struct getpgrp_args *uap) 153 { 154 struct proc *p = td->td_proc; 155 156 PROC_LOCK(p); 157 td->td_retval[0] = p->p_pgrp->pg_id; 158 PROC_UNLOCK(p); 159 return (0); 160 } 161 162 /* Get an arbitrary pid's process group id */ 163 #ifndef _SYS_SYSPROTO_H_ 164 struct getpgid_args { 165 pid_t pid; 166 }; 167 #endif 168 int 169 sys_getpgid(struct thread *td, struct getpgid_args *uap) 170 { 171 struct proc *p; 172 int error; 173 174 if (uap->pid == 0) { 175 p = td->td_proc; 176 PROC_LOCK(p); 177 } else { 178 p = pfind(uap->pid); 179 if (p == NULL) 180 return (ESRCH); 181 error = p_cansee(td, p); 182 if (error) { 183 PROC_UNLOCK(p); 184 return (error); 185 } 186 } 187 td->td_retval[0] = p->p_pgrp->pg_id; 188 PROC_UNLOCK(p); 189 return (0); 190 } 191 192 /* 193 * Get an arbitrary pid's session id. 194 */ 195 #ifndef _SYS_SYSPROTO_H_ 196 struct getsid_args { 197 pid_t pid; 198 }; 199 #endif 200 int 201 sys_getsid(struct thread *td, struct getsid_args *uap) 202 { 203 struct proc *p; 204 int error; 205 206 if (uap->pid == 0) { 207 p = td->td_proc; 208 PROC_LOCK(p); 209 } else { 210 p = pfind(uap->pid); 211 if (p == NULL) 212 return (ESRCH); 213 error = p_cansee(td, p); 214 if (error) { 215 PROC_UNLOCK(p); 216 return (error); 217 } 218 } 219 td->td_retval[0] = p->p_session->s_sid; 220 PROC_UNLOCK(p); 221 return (0); 222 } 223 224 #ifndef _SYS_SYSPROTO_H_ 225 struct getuid_args { 226 int dummy; 227 }; 228 #endif 229 /* ARGSUSED */ 230 int 231 sys_getuid(struct thread *td, struct getuid_args *uap) 232 { 233 234 td->td_retval[0] = td->td_ucred->cr_ruid; 235 #if defined(COMPAT_43) 236 td->td_retval[1] = td->td_ucred->cr_uid; 237 #endif 238 return (0); 239 } 240 241 #ifndef _SYS_SYSPROTO_H_ 242 struct geteuid_args { 243 int dummy; 244 }; 245 #endif 246 /* ARGSUSED */ 247 int 248 sys_geteuid(struct thread *td, struct geteuid_args *uap) 249 { 250 251 td->td_retval[0] = td->td_ucred->cr_uid; 252 return (0); 253 } 254 255 #ifndef _SYS_SYSPROTO_H_ 256 struct getgid_args { 257 int dummy; 258 }; 259 #endif 260 /* ARGSUSED */ 261 int 262 sys_getgid(struct thread *td, struct getgid_args *uap) 263 { 264 265 td->td_retval[0] = td->td_ucred->cr_rgid; 266 #if defined(COMPAT_43) 267 td->td_retval[1] = td->td_ucred->cr_groups[0]; 268 #endif 269 return (0); 270 } 271 272 /* 273 * Get effective group ID. The "egid" is groups[0], and could be obtained 274 * via getgroups. This syscall exists because it is somewhat painful to do 275 * correctly in a library function. 276 */ 277 #ifndef _SYS_SYSPROTO_H_ 278 struct getegid_args { 279 int dummy; 280 }; 281 #endif 282 /* ARGSUSED */ 283 int 284 sys_getegid(struct thread *td, struct getegid_args *uap) 285 { 286 287 td->td_retval[0] = td->td_ucred->cr_groups[0]; 288 return (0); 289 } 290 291 #ifndef _SYS_SYSPROTO_H_ 292 struct getgroups_args { 293 u_int gidsetsize; 294 gid_t *gidset; 295 }; 296 #endif 297 int 298 sys_getgroups(struct thread *td, struct getgroups_args *uap) 299 { 300 struct ucred *cred; 301 u_int ngrp; 302 int error; 303 304 cred = td->td_ucred; 305 ngrp = cred->cr_ngroups; 306 307 if (uap->gidsetsize == 0) { 308 error = 0; 309 goto out; 310 } 311 if (uap->gidsetsize < ngrp) 312 return (EINVAL); 313 314 error = copyout(cred->cr_groups, uap->gidset, ngrp * sizeof(gid_t)); 315 out: 316 td->td_retval[0] = ngrp; 317 return (error); 318 } 319 320 #ifndef _SYS_SYSPROTO_H_ 321 struct setsid_args { 322 int dummy; 323 }; 324 #endif 325 /* ARGSUSED */ 326 int 327 sys_setsid(struct thread *td, struct setsid_args *uap) 328 { 329 struct pgrp *pgrp; 330 int error; 331 struct proc *p = td->td_proc; 332 struct pgrp *newpgrp; 333 struct session *newsess; 334 335 error = 0; 336 pgrp = NULL; 337 338 newpgrp = malloc(sizeof(struct pgrp), M_PGRP, M_WAITOK | M_ZERO); 339 newsess = malloc(sizeof(struct session), M_SESSION, M_WAITOK | M_ZERO); 340 341 sx_xlock(&proctree_lock); 342 343 if (p->p_pgid == p->p_pid || (pgrp = pgfind(p->p_pid)) != NULL) { 344 if (pgrp != NULL) 345 PGRP_UNLOCK(pgrp); 346 error = EPERM; 347 } else { 348 (void)enterpgrp(p, p->p_pid, newpgrp, newsess); 349 td->td_retval[0] = p->p_pid; 350 newpgrp = NULL; 351 newsess = NULL; 352 } 353 354 sx_xunlock(&proctree_lock); 355 356 if (newpgrp != NULL) 357 free(newpgrp, M_PGRP); 358 if (newsess != NULL) 359 free(newsess, M_SESSION); 360 361 return (error); 362 } 363 364 /* 365 * set process group (setpgid/old setpgrp) 366 * 367 * caller does setpgid(targpid, targpgid) 368 * 369 * pid must be caller or child of caller (ESRCH) 370 * if a child 371 * pid must be in same session (EPERM) 372 * pid can't have done an exec (EACCES) 373 * if pgid != pid 374 * there must exist some pid in same session having pgid (EPERM) 375 * pid must not be session leader (EPERM) 376 */ 377 #ifndef _SYS_SYSPROTO_H_ 378 struct setpgid_args { 379 int pid; /* target process id */ 380 int pgid; /* target pgrp id */ 381 }; 382 #endif 383 /* ARGSUSED */ 384 int 385 sys_setpgid(struct thread *td, struct setpgid_args *uap) 386 { 387 struct proc *curp = td->td_proc; 388 struct proc *targp; /* target process */ 389 struct pgrp *pgrp; /* target pgrp */ 390 int error; 391 struct pgrp *newpgrp; 392 393 if (uap->pgid < 0) 394 return (EINVAL); 395 396 error = 0; 397 398 newpgrp = malloc(sizeof(struct pgrp), M_PGRP, M_WAITOK | M_ZERO); 399 400 sx_xlock(&proctree_lock); 401 if (uap->pid != 0 && uap->pid != curp->p_pid) { 402 if ((targp = pfind(uap->pid)) == NULL) { 403 error = ESRCH; 404 goto done; 405 } 406 if (!inferior(targp)) { 407 PROC_UNLOCK(targp); 408 error = ESRCH; 409 goto done; 410 } 411 if ((error = p_cansee(td, targp))) { 412 PROC_UNLOCK(targp); 413 goto done; 414 } 415 if (targp->p_pgrp == NULL || 416 targp->p_session != curp->p_session) { 417 PROC_UNLOCK(targp); 418 error = EPERM; 419 goto done; 420 } 421 if (targp->p_flag & P_EXEC) { 422 PROC_UNLOCK(targp); 423 error = EACCES; 424 goto done; 425 } 426 PROC_UNLOCK(targp); 427 } else 428 targp = curp; 429 if (SESS_LEADER(targp)) { 430 error = EPERM; 431 goto done; 432 } 433 if (uap->pgid == 0) 434 uap->pgid = targp->p_pid; 435 if ((pgrp = pgfind(uap->pgid)) == NULL) { 436 if (uap->pgid == targp->p_pid) { 437 error = enterpgrp(targp, uap->pgid, newpgrp, 438 NULL); 439 if (error == 0) 440 newpgrp = NULL; 441 } else 442 error = EPERM; 443 } else { 444 if (pgrp == targp->p_pgrp) { 445 PGRP_UNLOCK(pgrp); 446 goto done; 447 } 448 if (pgrp->pg_id != targp->p_pid && 449 pgrp->pg_session != curp->p_session) { 450 PGRP_UNLOCK(pgrp); 451 error = EPERM; 452 goto done; 453 } 454 PGRP_UNLOCK(pgrp); 455 error = enterthispgrp(targp, pgrp); 456 } 457 done: 458 sx_xunlock(&proctree_lock); 459 KASSERT((error == 0) || (newpgrp != NULL), 460 ("setpgid failed and newpgrp is NULL")); 461 if (newpgrp != NULL) 462 free(newpgrp, M_PGRP); 463 return (error); 464 } 465 466 /* 467 * Use the clause in B.4.2.2 that allows setuid/setgid to be 4.2/4.3BSD 468 * compatible. It says that setting the uid/gid to euid/egid is a special 469 * case of "appropriate privilege". Once the rules are expanded out, this 470 * basically means that setuid(nnn) sets all three id's, in all permitted 471 * cases unless _POSIX_SAVED_IDS is enabled. In that case, setuid(getuid()) 472 * does not set the saved id - this is dangerous for traditional BSD 473 * programs. For this reason, we *really* do not want to set 474 * _POSIX_SAVED_IDS and do not want to clear POSIX_APPENDIX_B_4_2_2. 475 */ 476 #define POSIX_APPENDIX_B_4_2_2 477 478 #ifndef _SYS_SYSPROTO_H_ 479 struct setuid_args { 480 uid_t uid; 481 }; 482 #endif 483 /* ARGSUSED */ 484 int 485 sys_setuid(struct thread *td, struct setuid_args *uap) 486 { 487 struct proc *p = td->td_proc; 488 struct ucred *newcred, *oldcred; 489 uid_t uid; 490 struct uidinfo *uip; 491 int error; 492 493 uid = uap->uid; 494 AUDIT_ARG_UID(uid); 495 newcred = crget(); 496 uip = uifind(uid); 497 PROC_LOCK(p); 498 /* 499 * Copy credentials so other references do not see our changes. 500 */ 501 oldcred = crcopysafe(p, newcred); 502 503 #ifdef MAC 504 error = mac_cred_check_setuid(oldcred, uid); 505 if (error) 506 goto fail; 507 #endif 508 509 /* 510 * See if we have "permission" by POSIX 1003.1 rules. 511 * 512 * Note that setuid(geteuid()) is a special case of 513 * "appropriate privileges" in appendix B.4.2.2. We need 514 * to use this clause to be compatible with traditional BSD 515 * semantics. Basically, it means that "setuid(xx)" sets all 516 * three id's (assuming you have privs). 517 * 518 * Notes on the logic. We do things in three steps. 519 * 1: We determine if the euid is going to change, and do EPERM 520 * right away. We unconditionally change the euid later if this 521 * test is satisfied, simplifying that part of the logic. 522 * 2: We determine if the real and/or saved uids are going to 523 * change. Determined by compile options. 524 * 3: Change euid last. (after tests in #2 for "appropriate privs") 525 */ 526 if (uid != oldcred->cr_ruid && /* allow setuid(getuid()) */ 527 #ifdef _POSIX_SAVED_IDS 528 uid != oldcred->cr_svuid && /* allow setuid(saved gid) */ 529 #endif 530 #ifdef POSIX_APPENDIX_B_4_2_2 /* Use BSD-compat clause from B.4.2.2 */ 531 uid != oldcred->cr_uid && /* allow setuid(geteuid()) */ 532 #endif 533 (error = priv_check_cred(oldcred, PRIV_CRED_SETUID, 0)) != 0) 534 goto fail; 535 536 #ifdef _POSIX_SAVED_IDS 537 /* 538 * Do we have "appropriate privileges" (are we root or uid == euid) 539 * If so, we are changing the real uid and/or saved uid. 540 */ 541 if ( 542 #ifdef POSIX_APPENDIX_B_4_2_2 /* Use the clause from B.4.2.2 */ 543 uid == oldcred->cr_uid || 544 #endif 545 /* We are using privs. */ 546 priv_check_cred(oldcred, PRIV_CRED_SETUID, 0) == 0) 547 #endif 548 { 549 /* 550 * Set the real uid and transfer proc count to new user. 551 */ 552 if (uid != oldcred->cr_ruid) { 553 change_ruid(newcred, uip); 554 setsugid(p); 555 } 556 /* 557 * Set saved uid 558 * 559 * XXX always set saved uid even if not _POSIX_SAVED_IDS, as 560 * the security of seteuid() depends on it. B.4.2.2 says it 561 * is important that we should do this. 562 */ 563 if (uid != oldcred->cr_svuid) { 564 change_svuid(newcred, uid); 565 setsugid(p); 566 } 567 } 568 569 /* 570 * In all permitted cases, we are changing the euid. 571 */ 572 if (uid != oldcred->cr_uid) { 573 change_euid(newcred, uip); 574 setsugid(p); 575 } 576 proc_set_cred(p, newcred); 577 PROC_UNLOCK(p); 578 #ifdef RACCT 579 racct_proc_ucred_changed(p, oldcred, newcred); 580 #endif 581 uifree(uip); 582 crfree(oldcred); 583 return (0); 584 585 fail: 586 PROC_UNLOCK(p); 587 uifree(uip); 588 crfree(newcred); 589 return (error); 590 } 591 592 #ifndef _SYS_SYSPROTO_H_ 593 struct seteuid_args { 594 uid_t euid; 595 }; 596 #endif 597 /* ARGSUSED */ 598 int 599 sys_seteuid(struct thread *td, struct seteuid_args *uap) 600 { 601 struct proc *p = td->td_proc; 602 struct ucred *newcred, *oldcred; 603 uid_t euid; 604 struct uidinfo *euip; 605 int error; 606 607 euid = uap->euid; 608 AUDIT_ARG_EUID(euid); 609 newcred = crget(); 610 euip = uifind(euid); 611 PROC_LOCK(p); 612 /* 613 * Copy credentials so other references do not see our changes. 614 */ 615 oldcred = crcopysafe(p, newcred); 616 617 #ifdef MAC 618 error = mac_cred_check_seteuid(oldcred, euid); 619 if (error) 620 goto fail; 621 #endif 622 623 if (euid != oldcred->cr_ruid && /* allow seteuid(getuid()) */ 624 euid != oldcred->cr_svuid && /* allow seteuid(saved uid) */ 625 (error = priv_check_cred(oldcred, PRIV_CRED_SETEUID, 0)) != 0) 626 goto fail; 627 628 /* 629 * Everything's okay, do it. 630 */ 631 if (oldcred->cr_uid != euid) { 632 change_euid(newcred, euip); 633 setsugid(p); 634 } 635 proc_set_cred(p, newcred); 636 PROC_UNLOCK(p); 637 uifree(euip); 638 crfree(oldcred); 639 return (0); 640 641 fail: 642 PROC_UNLOCK(p); 643 uifree(euip); 644 crfree(newcred); 645 return (error); 646 } 647 648 #ifndef _SYS_SYSPROTO_H_ 649 struct setgid_args { 650 gid_t gid; 651 }; 652 #endif 653 /* ARGSUSED */ 654 int 655 sys_setgid(struct thread *td, struct setgid_args *uap) 656 { 657 struct proc *p = td->td_proc; 658 struct ucred *newcred, *oldcred; 659 gid_t gid; 660 int error; 661 662 gid = uap->gid; 663 AUDIT_ARG_GID(gid); 664 newcred = crget(); 665 PROC_LOCK(p); 666 oldcred = crcopysafe(p, newcred); 667 668 #ifdef MAC 669 error = mac_cred_check_setgid(oldcred, gid); 670 if (error) 671 goto fail; 672 #endif 673 674 /* 675 * See if we have "permission" by POSIX 1003.1 rules. 676 * 677 * Note that setgid(getegid()) is a special case of 678 * "appropriate privileges" in appendix B.4.2.2. We need 679 * to use this clause to be compatible with traditional BSD 680 * semantics. Basically, it means that "setgid(xx)" sets all 681 * three id's (assuming you have privs). 682 * 683 * For notes on the logic here, see setuid() above. 684 */ 685 if (gid != oldcred->cr_rgid && /* allow setgid(getgid()) */ 686 #ifdef _POSIX_SAVED_IDS 687 gid != oldcred->cr_svgid && /* allow setgid(saved gid) */ 688 #endif 689 #ifdef POSIX_APPENDIX_B_4_2_2 /* Use BSD-compat clause from B.4.2.2 */ 690 gid != oldcred->cr_groups[0] && /* allow setgid(getegid()) */ 691 #endif 692 (error = priv_check_cred(oldcred, PRIV_CRED_SETGID, 0)) != 0) 693 goto fail; 694 695 #ifdef _POSIX_SAVED_IDS 696 /* 697 * Do we have "appropriate privileges" (are we root or gid == egid) 698 * If so, we are changing the real uid and saved gid. 699 */ 700 if ( 701 #ifdef POSIX_APPENDIX_B_4_2_2 /* use the clause from B.4.2.2 */ 702 gid == oldcred->cr_groups[0] || 703 #endif 704 /* We are using privs. */ 705 priv_check_cred(oldcred, PRIV_CRED_SETGID, 0) == 0) 706 #endif 707 { 708 /* 709 * Set real gid 710 */ 711 if (oldcred->cr_rgid != gid) { 712 change_rgid(newcred, gid); 713 setsugid(p); 714 } 715 /* 716 * Set saved gid 717 * 718 * XXX always set saved gid even if not _POSIX_SAVED_IDS, as 719 * the security of setegid() depends on it. B.4.2.2 says it 720 * is important that we should do this. 721 */ 722 if (oldcred->cr_svgid != gid) { 723 change_svgid(newcred, gid); 724 setsugid(p); 725 } 726 } 727 /* 728 * In all cases permitted cases, we are changing the egid. 729 * Copy credentials so other references do not see our changes. 730 */ 731 if (oldcred->cr_groups[0] != gid) { 732 change_egid(newcred, gid); 733 setsugid(p); 734 } 735 proc_set_cred(p, newcred); 736 PROC_UNLOCK(p); 737 crfree(oldcred); 738 return (0); 739 740 fail: 741 PROC_UNLOCK(p); 742 crfree(newcred); 743 return (error); 744 } 745 746 #ifndef _SYS_SYSPROTO_H_ 747 struct setegid_args { 748 gid_t egid; 749 }; 750 #endif 751 /* ARGSUSED */ 752 int 753 sys_setegid(struct thread *td, struct setegid_args *uap) 754 { 755 struct proc *p = td->td_proc; 756 struct ucred *newcred, *oldcred; 757 gid_t egid; 758 int error; 759 760 egid = uap->egid; 761 AUDIT_ARG_EGID(egid); 762 newcred = crget(); 763 PROC_LOCK(p); 764 oldcred = crcopysafe(p, newcred); 765 766 #ifdef MAC 767 error = mac_cred_check_setegid(oldcred, egid); 768 if (error) 769 goto fail; 770 #endif 771 772 if (egid != oldcred->cr_rgid && /* allow setegid(getgid()) */ 773 egid != oldcred->cr_svgid && /* allow setegid(saved gid) */ 774 (error = priv_check_cred(oldcred, PRIV_CRED_SETEGID, 0)) != 0) 775 goto fail; 776 777 if (oldcred->cr_groups[0] != egid) { 778 change_egid(newcred, egid); 779 setsugid(p); 780 } 781 proc_set_cred(p, newcred); 782 PROC_UNLOCK(p); 783 crfree(oldcred); 784 return (0); 785 786 fail: 787 PROC_UNLOCK(p); 788 crfree(newcred); 789 return (error); 790 } 791 792 #ifndef _SYS_SYSPROTO_H_ 793 struct setgroups_args { 794 u_int gidsetsize; 795 gid_t *gidset; 796 }; 797 #endif 798 /* ARGSUSED */ 799 int 800 sys_setgroups(struct thread *td, struct setgroups_args *uap) 801 { 802 gid_t smallgroups[XU_NGROUPS]; 803 gid_t *groups; 804 u_int gidsetsize; 805 int error; 806 807 gidsetsize = uap->gidsetsize; 808 if (gidsetsize > ngroups_max + 1) 809 return (EINVAL); 810 811 if (gidsetsize > XU_NGROUPS) 812 groups = malloc(gidsetsize * sizeof(gid_t), M_TEMP, M_WAITOK); 813 else 814 groups = smallgroups; 815 816 error = copyin(uap->gidset, groups, gidsetsize * sizeof(gid_t)); 817 if (error == 0) 818 error = kern_setgroups(td, gidsetsize, groups); 819 820 if (gidsetsize > XU_NGROUPS) 821 free(groups, M_TEMP); 822 return (error); 823 } 824 825 int 826 kern_setgroups(struct thread *td, u_int ngrp, gid_t *groups) 827 { 828 struct proc *p = td->td_proc; 829 struct ucred *newcred, *oldcred; 830 int error; 831 832 MPASS(ngrp <= ngroups_max + 1); 833 AUDIT_ARG_GROUPSET(groups, ngrp); 834 newcred = crget(); 835 crextend(newcred, ngrp); 836 PROC_LOCK(p); 837 oldcred = crcopysafe(p, newcred); 838 839 #ifdef MAC 840 error = mac_cred_check_setgroups(oldcred, ngrp, groups); 841 if (error) 842 goto fail; 843 #endif 844 845 error = priv_check_cred(oldcred, PRIV_CRED_SETGROUPS, 0); 846 if (error) 847 goto fail; 848 849 if (ngrp == 0) { 850 /* 851 * setgroups(0, NULL) is a legitimate way of clearing the 852 * groups vector on non-BSD systems (which generally do not 853 * have the egid in the groups[0]). We risk security holes 854 * when running non-BSD software if we do not do the same. 855 */ 856 newcred->cr_ngroups = 1; 857 } else { 858 crsetgroups_locked(newcred, ngrp, groups); 859 } 860 setsugid(p); 861 proc_set_cred(p, newcred); 862 PROC_UNLOCK(p); 863 crfree(oldcred); 864 return (0); 865 866 fail: 867 PROC_UNLOCK(p); 868 crfree(newcred); 869 return (error); 870 } 871 872 #ifndef _SYS_SYSPROTO_H_ 873 struct setreuid_args { 874 uid_t ruid; 875 uid_t euid; 876 }; 877 #endif 878 /* ARGSUSED */ 879 int 880 sys_setreuid(struct thread *td, struct setreuid_args *uap) 881 { 882 struct proc *p = td->td_proc; 883 struct ucred *newcred, *oldcred; 884 uid_t euid, ruid; 885 struct uidinfo *euip, *ruip; 886 int error; 887 888 euid = uap->euid; 889 ruid = uap->ruid; 890 AUDIT_ARG_EUID(euid); 891 AUDIT_ARG_RUID(ruid); 892 newcred = crget(); 893 euip = uifind(euid); 894 ruip = uifind(ruid); 895 PROC_LOCK(p); 896 oldcred = crcopysafe(p, newcred); 897 898 #ifdef MAC 899 error = mac_cred_check_setreuid(oldcred, ruid, euid); 900 if (error) 901 goto fail; 902 #endif 903 904 if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid && 905 ruid != oldcred->cr_svuid) || 906 (euid != (uid_t)-1 && euid != oldcred->cr_uid && 907 euid != oldcred->cr_ruid && euid != oldcred->cr_svuid)) && 908 (error = priv_check_cred(oldcred, PRIV_CRED_SETREUID, 0)) != 0) 909 goto fail; 910 911 if (euid != (uid_t)-1 && oldcred->cr_uid != euid) { 912 change_euid(newcred, euip); 913 setsugid(p); 914 } 915 if (ruid != (uid_t)-1 && oldcred->cr_ruid != ruid) { 916 change_ruid(newcred, ruip); 917 setsugid(p); 918 } 919 if ((ruid != (uid_t)-1 || newcred->cr_uid != newcred->cr_ruid) && 920 newcred->cr_svuid != newcred->cr_uid) { 921 change_svuid(newcred, newcred->cr_uid); 922 setsugid(p); 923 } 924 proc_set_cred(p, newcred); 925 PROC_UNLOCK(p); 926 #ifdef RACCT 927 racct_proc_ucred_changed(p, oldcred, newcred); 928 #endif 929 uifree(ruip); 930 uifree(euip); 931 crfree(oldcred); 932 return (0); 933 934 fail: 935 PROC_UNLOCK(p); 936 uifree(ruip); 937 uifree(euip); 938 crfree(newcred); 939 return (error); 940 } 941 942 #ifndef _SYS_SYSPROTO_H_ 943 struct setregid_args { 944 gid_t rgid; 945 gid_t egid; 946 }; 947 #endif 948 /* ARGSUSED */ 949 int 950 sys_setregid(struct thread *td, struct setregid_args *uap) 951 { 952 struct proc *p = td->td_proc; 953 struct ucred *newcred, *oldcred; 954 gid_t egid, rgid; 955 int error; 956 957 egid = uap->egid; 958 rgid = uap->rgid; 959 AUDIT_ARG_EGID(egid); 960 AUDIT_ARG_RGID(rgid); 961 newcred = crget(); 962 PROC_LOCK(p); 963 oldcred = crcopysafe(p, newcred); 964 965 #ifdef MAC 966 error = mac_cred_check_setregid(oldcred, rgid, egid); 967 if (error) 968 goto fail; 969 #endif 970 971 if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid && 972 rgid != oldcred->cr_svgid) || 973 (egid != (gid_t)-1 && egid != oldcred->cr_groups[0] && 974 egid != oldcred->cr_rgid && egid != oldcred->cr_svgid)) && 975 (error = priv_check_cred(oldcred, PRIV_CRED_SETREGID, 0)) != 0) 976 goto fail; 977 978 if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) { 979 change_egid(newcred, egid); 980 setsugid(p); 981 } 982 if (rgid != (gid_t)-1 && oldcred->cr_rgid != rgid) { 983 change_rgid(newcred, rgid); 984 setsugid(p); 985 } 986 if ((rgid != (gid_t)-1 || newcred->cr_groups[0] != newcred->cr_rgid) && 987 newcred->cr_svgid != newcred->cr_groups[0]) { 988 change_svgid(newcred, newcred->cr_groups[0]); 989 setsugid(p); 990 } 991 proc_set_cred(p, newcred); 992 PROC_UNLOCK(p); 993 crfree(oldcred); 994 return (0); 995 996 fail: 997 PROC_UNLOCK(p); 998 crfree(newcred); 999 return (error); 1000 } 1001 1002 /* 1003 * setresuid(ruid, euid, suid) is like setreuid except control over the saved 1004 * uid is explicit. 1005 */ 1006 #ifndef _SYS_SYSPROTO_H_ 1007 struct setresuid_args { 1008 uid_t ruid; 1009 uid_t euid; 1010 uid_t suid; 1011 }; 1012 #endif 1013 /* ARGSUSED */ 1014 int 1015 sys_setresuid(struct thread *td, struct setresuid_args *uap) 1016 { 1017 struct proc *p = td->td_proc; 1018 struct ucred *newcred, *oldcred; 1019 uid_t euid, ruid, suid; 1020 struct uidinfo *euip, *ruip; 1021 int error; 1022 1023 euid = uap->euid; 1024 ruid = uap->ruid; 1025 suid = uap->suid; 1026 AUDIT_ARG_EUID(euid); 1027 AUDIT_ARG_RUID(ruid); 1028 AUDIT_ARG_SUID(suid); 1029 newcred = crget(); 1030 euip = uifind(euid); 1031 ruip = uifind(ruid); 1032 PROC_LOCK(p); 1033 oldcred = crcopysafe(p, newcred); 1034 1035 #ifdef MAC 1036 error = mac_cred_check_setresuid(oldcred, ruid, euid, suid); 1037 if (error) 1038 goto fail; 1039 #endif 1040 1041 if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid && 1042 ruid != oldcred->cr_svuid && 1043 ruid != oldcred->cr_uid) || 1044 (euid != (uid_t)-1 && euid != oldcred->cr_ruid && 1045 euid != oldcred->cr_svuid && 1046 euid != oldcred->cr_uid) || 1047 (suid != (uid_t)-1 && suid != oldcred->cr_ruid && 1048 suid != oldcred->cr_svuid && 1049 suid != oldcred->cr_uid)) && 1050 (error = priv_check_cred(oldcred, PRIV_CRED_SETRESUID, 0)) != 0) 1051 goto fail; 1052 1053 if (euid != (uid_t)-1 && oldcred->cr_uid != euid) { 1054 change_euid(newcred, euip); 1055 setsugid(p); 1056 } 1057 if (ruid != (uid_t)-1 && oldcred->cr_ruid != ruid) { 1058 change_ruid(newcred, ruip); 1059 setsugid(p); 1060 } 1061 if (suid != (uid_t)-1 && oldcred->cr_svuid != suid) { 1062 change_svuid(newcred, suid); 1063 setsugid(p); 1064 } 1065 proc_set_cred(p, newcred); 1066 PROC_UNLOCK(p); 1067 #ifdef RACCT 1068 racct_proc_ucred_changed(p, oldcred, newcred); 1069 #endif 1070 uifree(ruip); 1071 uifree(euip); 1072 crfree(oldcred); 1073 return (0); 1074 1075 fail: 1076 PROC_UNLOCK(p); 1077 uifree(ruip); 1078 uifree(euip); 1079 crfree(newcred); 1080 return (error); 1081 1082 } 1083 1084 /* 1085 * setresgid(rgid, egid, sgid) is like setregid except control over the saved 1086 * gid is explicit. 1087 */ 1088 #ifndef _SYS_SYSPROTO_H_ 1089 struct setresgid_args { 1090 gid_t rgid; 1091 gid_t egid; 1092 gid_t sgid; 1093 }; 1094 #endif 1095 /* ARGSUSED */ 1096 int 1097 sys_setresgid(struct thread *td, struct setresgid_args *uap) 1098 { 1099 struct proc *p = td->td_proc; 1100 struct ucred *newcred, *oldcred; 1101 gid_t egid, rgid, sgid; 1102 int error; 1103 1104 egid = uap->egid; 1105 rgid = uap->rgid; 1106 sgid = uap->sgid; 1107 AUDIT_ARG_EGID(egid); 1108 AUDIT_ARG_RGID(rgid); 1109 AUDIT_ARG_SGID(sgid); 1110 newcred = crget(); 1111 PROC_LOCK(p); 1112 oldcred = crcopysafe(p, newcred); 1113 1114 #ifdef MAC 1115 error = mac_cred_check_setresgid(oldcred, rgid, egid, sgid); 1116 if (error) 1117 goto fail; 1118 #endif 1119 1120 if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid && 1121 rgid != oldcred->cr_svgid && 1122 rgid != oldcred->cr_groups[0]) || 1123 (egid != (gid_t)-1 && egid != oldcred->cr_rgid && 1124 egid != oldcred->cr_svgid && 1125 egid != oldcred->cr_groups[0]) || 1126 (sgid != (gid_t)-1 && sgid != oldcred->cr_rgid && 1127 sgid != oldcred->cr_svgid && 1128 sgid != oldcred->cr_groups[0])) && 1129 (error = priv_check_cred(oldcred, PRIV_CRED_SETRESGID, 0)) != 0) 1130 goto fail; 1131 1132 if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) { 1133 change_egid(newcred, egid); 1134 setsugid(p); 1135 } 1136 if (rgid != (gid_t)-1 && oldcred->cr_rgid != rgid) { 1137 change_rgid(newcred, rgid); 1138 setsugid(p); 1139 } 1140 if (sgid != (gid_t)-1 && oldcred->cr_svgid != sgid) { 1141 change_svgid(newcred, sgid); 1142 setsugid(p); 1143 } 1144 proc_set_cred(p, newcred); 1145 PROC_UNLOCK(p); 1146 crfree(oldcred); 1147 return (0); 1148 1149 fail: 1150 PROC_UNLOCK(p); 1151 crfree(newcred); 1152 return (error); 1153 } 1154 1155 #ifndef _SYS_SYSPROTO_H_ 1156 struct getresuid_args { 1157 uid_t *ruid; 1158 uid_t *euid; 1159 uid_t *suid; 1160 }; 1161 #endif 1162 /* ARGSUSED */ 1163 int 1164 sys_getresuid(struct thread *td, struct getresuid_args *uap) 1165 { 1166 struct ucred *cred; 1167 int error1 = 0, error2 = 0, error3 = 0; 1168 1169 cred = td->td_ucred; 1170 if (uap->ruid) 1171 error1 = copyout(&cred->cr_ruid, 1172 uap->ruid, sizeof(cred->cr_ruid)); 1173 if (uap->euid) 1174 error2 = copyout(&cred->cr_uid, 1175 uap->euid, sizeof(cred->cr_uid)); 1176 if (uap->suid) 1177 error3 = copyout(&cred->cr_svuid, 1178 uap->suid, sizeof(cred->cr_svuid)); 1179 return (error1 ? error1 : error2 ? error2 : error3); 1180 } 1181 1182 #ifndef _SYS_SYSPROTO_H_ 1183 struct getresgid_args { 1184 gid_t *rgid; 1185 gid_t *egid; 1186 gid_t *sgid; 1187 }; 1188 #endif 1189 /* ARGSUSED */ 1190 int 1191 sys_getresgid(struct thread *td, struct getresgid_args *uap) 1192 { 1193 struct ucred *cred; 1194 int error1 = 0, error2 = 0, error3 = 0; 1195 1196 cred = td->td_ucred; 1197 if (uap->rgid) 1198 error1 = copyout(&cred->cr_rgid, 1199 uap->rgid, sizeof(cred->cr_rgid)); 1200 if (uap->egid) 1201 error2 = copyout(&cred->cr_groups[0], 1202 uap->egid, sizeof(cred->cr_groups[0])); 1203 if (uap->sgid) 1204 error3 = copyout(&cred->cr_svgid, 1205 uap->sgid, sizeof(cred->cr_svgid)); 1206 return (error1 ? error1 : error2 ? error2 : error3); 1207 } 1208 1209 #ifndef _SYS_SYSPROTO_H_ 1210 struct issetugid_args { 1211 int dummy; 1212 }; 1213 #endif 1214 /* ARGSUSED */ 1215 int 1216 sys_issetugid(struct thread *td, struct issetugid_args *uap) 1217 { 1218 struct proc *p = td->td_proc; 1219 1220 /* 1221 * Note: OpenBSD sets a P_SUGIDEXEC flag set at execve() time, 1222 * we use P_SUGID because we consider changing the owners as 1223 * "tainting" as well. 1224 * This is significant for procs that start as root and "become" 1225 * a user without an exec - programs cannot know *everything* 1226 * that libc *might* have put in their data segment. 1227 */ 1228 td->td_retval[0] = (p->p_flag & P_SUGID) ? 1 : 0; 1229 return (0); 1230 } 1231 1232 int 1233 sys___setugid(struct thread *td, struct __setugid_args *uap) 1234 { 1235 #ifdef REGRESSION 1236 struct proc *p; 1237 1238 p = td->td_proc; 1239 switch (uap->flag) { 1240 case 0: 1241 PROC_LOCK(p); 1242 p->p_flag &= ~P_SUGID; 1243 PROC_UNLOCK(p); 1244 return (0); 1245 case 1: 1246 PROC_LOCK(p); 1247 p->p_flag |= P_SUGID; 1248 PROC_UNLOCK(p); 1249 return (0); 1250 default: 1251 return (EINVAL); 1252 } 1253 #else /* !REGRESSION */ 1254 1255 return (ENOSYS); 1256 #endif /* REGRESSION */ 1257 } 1258 1259 /* 1260 * Check if gid is a member of the group set. 1261 */ 1262 int 1263 groupmember(gid_t gid, struct ucred *cred) 1264 { 1265 int l; 1266 int h; 1267 int m; 1268 1269 if (cred->cr_groups[0] == gid) 1270 return(1); 1271 1272 /* 1273 * If gid was not our primary group, perform a binary search 1274 * of the supplemental groups. This is possible because we 1275 * sort the groups in crsetgroups(). 1276 */ 1277 l = 1; 1278 h = cred->cr_ngroups; 1279 while (l < h) { 1280 m = l + ((h - l) / 2); 1281 if (cred->cr_groups[m] < gid) 1282 l = m + 1; 1283 else 1284 h = m; 1285 } 1286 if ((l < cred->cr_ngroups) && (cred->cr_groups[l] == gid)) 1287 return (1); 1288 1289 return (0); 1290 } 1291 1292 /* 1293 * Test the active securelevel against a given level. securelevel_gt() 1294 * implements (securelevel > level). securelevel_ge() implements 1295 * (securelevel >= level). Note that the logic is inverted -- these 1296 * functions return EPERM on "success" and 0 on "failure". 1297 * 1298 * Due to care taken when setting the securelevel, we know that no jail will 1299 * be less secure that its parent (or the physical system), so it is sufficient 1300 * to test the current jail only. 1301 * 1302 * XXXRW: Possibly since this has to do with privilege, it should move to 1303 * kern_priv.c. 1304 */ 1305 int 1306 securelevel_gt(struct ucred *cr, int level) 1307 { 1308 1309 return (cr->cr_prison->pr_securelevel > level ? EPERM : 0); 1310 } 1311 1312 int 1313 securelevel_ge(struct ucred *cr, int level) 1314 { 1315 1316 return (cr->cr_prison->pr_securelevel >= level ? EPERM : 0); 1317 } 1318 1319 /* 1320 * 'see_other_uids' determines whether or not visibility of processes 1321 * and sockets with credentials holding different real uids is possible 1322 * using a variety of system MIBs. 1323 * XXX: data declarations should be together near the beginning of the file. 1324 */ 1325 static int see_other_uids = 1; 1326 SYSCTL_INT(_security_bsd, OID_AUTO, see_other_uids, CTLFLAG_RW, 1327 &see_other_uids, 0, 1328 "Unprivileged processes may see subjects/objects with different real uid"); 1329 1330 /*- 1331 * Determine if u1 "can see" the subject specified by u2, according to the 1332 * 'see_other_uids' policy. 1333 * Returns: 0 for permitted, ESRCH otherwise 1334 * Locks: none 1335 * References: *u1 and *u2 must not change during the call 1336 * u1 may equal u2, in which case only one reference is required 1337 */ 1338 int 1339 cr_canseeotheruids(struct ucred *u1, struct ucred *u2) 1340 { 1341 1342 if (!see_other_uids && u1->cr_ruid != u2->cr_ruid) { 1343 if (priv_check_cred(u1, PRIV_SEEOTHERUIDS, 0) != 0) 1344 return (ESRCH); 1345 } 1346 return (0); 1347 } 1348 1349 /* 1350 * 'see_other_gids' determines whether or not visibility of processes 1351 * and sockets with credentials holding different real gids is possible 1352 * using a variety of system MIBs. 1353 * XXX: data declarations should be together near the beginning of the file. 1354 */ 1355 static int see_other_gids = 1; 1356 SYSCTL_INT(_security_bsd, OID_AUTO, see_other_gids, CTLFLAG_RW, 1357 &see_other_gids, 0, 1358 "Unprivileged processes may see subjects/objects with different real gid"); 1359 1360 /* 1361 * Determine if u1 can "see" the subject specified by u2, according to the 1362 * 'see_other_gids' policy. 1363 * Returns: 0 for permitted, ESRCH otherwise 1364 * Locks: none 1365 * References: *u1 and *u2 must not change during the call 1366 * u1 may equal u2, in which case only one reference is required 1367 */ 1368 int 1369 cr_canseeothergids(struct ucred *u1, struct ucred *u2) 1370 { 1371 int i, match; 1372 1373 if (!see_other_gids) { 1374 match = 0; 1375 for (i = 0; i < u1->cr_ngroups; i++) { 1376 if (groupmember(u1->cr_groups[i], u2)) 1377 match = 1; 1378 if (match) 1379 break; 1380 } 1381 if (!match) { 1382 if (priv_check_cred(u1, PRIV_SEEOTHERGIDS, 0) != 0) 1383 return (ESRCH); 1384 } 1385 } 1386 return (0); 1387 } 1388 1389 /* 1390 * 'see_jail_proc' determines whether or not visibility of processes and 1391 * sockets with credentials holding different jail ids is possible using a 1392 * variety of system MIBs. 1393 * 1394 * XXX: data declarations should be together near the beginning of the file. 1395 */ 1396 1397 static int see_jail_proc = 1; 1398 SYSCTL_INT(_security_bsd, OID_AUTO, see_jail_proc, CTLFLAG_RW, 1399 &see_jail_proc, 0, 1400 "Unprivileged processes may see subjects/objects with different jail ids"); 1401 1402 /*- 1403 * Determine if u1 "can see" the subject specified by u2, according to the 1404 * 'see_jail_proc' policy. 1405 * Returns: 0 for permitted, ESRCH otherwise 1406 * Locks: none 1407 * References: *u1 and *u2 must not change during the call 1408 * u1 may equal u2, in which case only one reference is required 1409 */ 1410 int 1411 cr_canseejailproc(struct ucred *u1, struct ucred *u2) 1412 { 1413 if (u1->cr_uid == 0) 1414 return (0); 1415 return (!see_jail_proc && u1->cr_prison != u2->cr_prison ? ESRCH : 0); 1416 } 1417 1418 /*- 1419 * Determine if u1 "can see" the subject specified by u2. 1420 * Returns: 0 for permitted, an errno value otherwise 1421 * Locks: none 1422 * References: *u1 and *u2 must not change during the call 1423 * u1 may equal u2, in which case only one reference is required 1424 */ 1425 int 1426 cr_cansee(struct ucred *u1, struct ucred *u2) 1427 { 1428 int error; 1429 1430 if ((error = prison_check(u1, u2))) 1431 return (error); 1432 #ifdef MAC 1433 if ((error = mac_cred_check_visible(u1, u2))) 1434 return (error); 1435 #endif 1436 if ((error = cr_canseeotheruids(u1, u2))) 1437 return (error); 1438 if ((error = cr_canseeothergids(u1, u2))) 1439 return (error); 1440 if ((error = cr_canseejailproc(u1, u2))) 1441 return (error); 1442 return (0); 1443 } 1444 1445 /*- 1446 * Determine if td "can see" the subject specified by p. 1447 * Returns: 0 for permitted, an errno value otherwise 1448 * Locks: Sufficient locks to protect p->p_ucred must be held. td really 1449 * should be curthread. 1450 * References: td and p must be valid for the lifetime of the call 1451 */ 1452 int 1453 p_cansee(struct thread *td, struct proc *p) 1454 { 1455 1456 /* Wrap cr_cansee() for all functionality. */ 1457 KASSERT(td == curthread, ("%s: td not curthread", __func__)); 1458 PROC_LOCK_ASSERT(p, MA_OWNED); 1459 return (cr_cansee(td->td_ucred, p->p_ucred)); 1460 } 1461 1462 /* 1463 * 'conservative_signals' prevents the delivery of a broad class of 1464 * signals by unprivileged processes to processes that have changed their 1465 * credentials since the last invocation of execve(). This can prevent 1466 * the leakage of cached information or retained privileges as a result 1467 * of a common class of signal-related vulnerabilities. However, this 1468 * may interfere with some applications that expect to be able to 1469 * deliver these signals to peer processes after having given up 1470 * privilege. 1471 */ 1472 static int conservative_signals = 1; 1473 SYSCTL_INT(_security_bsd, OID_AUTO, conservative_signals, CTLFLAG_RW, 1474 &conservative_signals, 0, "Unprivileged processes prevented from " 1475 "sending certain signals to processes whose credentials have changed"); 1476 /*- 1477 * Determine whether cred may deliver the specified signal to proc. 1478 * Returns: 0 for permitted, an errno value otherwise. 1479 * Locks: A lock must be held for proc. 1480 * References: cred and proc must be valid for the lifetime of the call. 1481 */ 1482 int 1483 cr_cansignal(struct ucred *cred, struct proc *proc, int signum) 1484 { 1485 int error; 1486 1487 PROC_LOCK_ASSERT(proc, MA_OWNED); 1488 /* 1489 * Jail semantics limit the scope of signalling to proc in the 1490 * same jail as cred, if cred is in jail. 1491 */ 1492 error = prison_check(cred, proc->p_ucred); 1493 if (error) 1494 return (error); 1495 #ifdef MAC 1496 if ((error = mac_proc_check_signal(cred, proc, signum))) 1497 return (error); 1498 #endif 1499 if ((error = cr_canseeotheruids(cred, proc->p_ucred))) 1500 return (error); 1501 if ((error = cr_canseeothergids(cred, proc->p_ucred))) 1502 return (error); 1503 1504 /* 1505 * UNIX signal semantics depend on the status of the P_SUGID 1506 * bit on the target process. If the bit is set, then additional 1507 * restrictions are placed on the set of available signals. 1508 */ 1509 if (conservative_signals && (proc->p_flag & P_SUGID)) { 1510 switch (signum) { 1511 case 0: 1512 case SIGKILL: 1513 case SIGINT: 1514 case SIGTERM: 1515 case SIGALRM: 1516 case SIGSTOP: 1517 case SIGTTIN: 1518 case SIGTTOU: 1519 case SIGTSTP: 1520 case SIGHUP: 1521 case SIGUSR1: 1522 case SIGUSR2: 1523 /* 1524 * Generally, permit job and terminal control 1525 * signals. 1526 */ 1527 break; 1528 default: 1529 /* Not permitted without privilege. */ 1530 error = priv_check_cred(cred, PRIV_SIGNAL_SUGID, 0); 1531 if (error) 1532 return (error); 1533 } 1534 } 1535 1536 /* 1537 * Generally, the target credential's ruid or svuid must match the 1538 * subject credential's ruid or euid. 1539 */ 1540 if (cred->cr_ruid != proc->p_ucred->cr_ruid && 1541 cred->cr_ruid != proc->p_ucred->cr_svuid && 1542 cred->cr_uid != proc->p_ucred->cr_ruid && 1543 cred->cr_uid != proc->p_ucred->cr_svuid) { 1544 error = priv_check_cred(cred, PRIV_SIGNAL_DIFFCRED, 0); 1545 if (error) 1546 return (error); 1547 } 1548 1549 return (0); 1550 } 1551 1552 /*- 1553 * Determine whether td may deliver the specified signal to p. 1554 * Returns: 0 for permitted, an errno value otherwise 1555 * Locks: Sufficient locks to protect various components of td and p 1556 * must be held. td must be curthread, and a lock must be 1557 * held for p. 1558 * References: td and p must be valid for the lifetime of the call 1559 */ 1560 int 1561 p_cansignal(struct thread *td, struct proc *p, int signum) 1562 { 1563 1564 KASSERT(td == curthread, ("%s: td not curthread", __func__)); 1565 PROC_LOCK_ASSERT(p, MA_OWNED); 1566 if (td->td_proc == p) 1567 return (0); 1568 1569 /* 1570 * UNIX signalling semantics require that processes in the same 1571 * session always be able to deliver SIGCONT to one another, 1572 * overriding the remaining protections. 1573 */ 1574 /* XXX: This will require an additional lock of some sort. */ 1575 if (signum == SIGCONT && td->td_proc->p_session == p->p_session) 1576 return (0); 1577 /* 1578 * Some compat layers use SIGTHR and higher signals for 1579 * communication between different kernel threads of the same 1580 * process, so that they expect that it's always possible to 1581 * deliver them, even for suid applications where cr_cansignal() can 1582 * deny such ability for security consideration. It should be 1583 * pretty safe to do since the only way to create two processes 1584 * with the same p_leader is via rfork(2). 1585 */ 1586 if (td->td_proc->p_leader != NULL && signum >= SIGTHR && 1587 signum < SIGTHR + 4 && td->td_proc->p_leader == p->p_leader) 1588 return (0); 1589 1590 return (cr_cansignal(td->td_ucred, p, signum)); 1591 } 1592 1593 /*- 1594 * Determine whether td may reschedule p. 1595 * Returns: 0 for permitted, an errno value otherwise 1596 * Locks: Sufficient locks to protect various components of td and p 1597 * must be held. td must be curthread, and a lock must 1598 * be held for p. 1599 * References: td and p must be valid for the lifetime of the call 1600 */ 1601 int 1602 p_cansched(struct thread *td, struct proc *p) 1603 { 1604 int error; 1605 1606 KASSERT(td == curthread, ("%s: td not curthread", __func__)); 1607 PROC_LOCK_ASSERT(p, MA_OWNED); 1608 if (td->td_proc == p) 1609 return (0); 1610 if ((error = prison_check(td->td_ucred, p->p_ucred))) 1611 return (error); 1612 #ifdef MAC 1613 if ((error = mac_proc_check_sched(td->td_ucred, p))) 1614 return (error); 1615 #endif 1616 if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred))) 1617 return (error); 1618 if ((error = cr_canseeothergids(td->td_ucred, p->p_ucred))) 1619 return (error); 1620 if (td->td_ucred->cr_ruid != p->p_ucred->cr_ruid && 1621 td->td_ucred->cr_uid != p->p_ucred->cr_ruid) { 1622 error = priv_check(td, PRIV_SCHED_DIFFCRED); 1623 if (error) 1624 return (error); 1625 } 1626 return (0); 1627 } 1628 1629 /* 1630 * The 'unprivileged_proc_debug' flag may be used to disable a variety of 1631 * unprivileged inter-process debugging services, including some procfs 1632 * functionality, ptrace(), and ktrace(). In the past, inter-process 1633 * debugging has been involved in a variety of security problems, and sites 1634 * not requiring the service might choose to disable it when hardening 1635 * systems. 1636 * 1637 * XXX: Should modifying and reading this variable require locking? 1638 * XXX: data declarations should be together near the beginning of the file. 1639 */ 1640 static int unprivileged_proc_debug = 1; 1641 SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_proc_debug, CTLFLAG_RW, 1642 &unprivileged_proc_debug, 0, 1643 "Unprivileged processes may use process debugging facilities"); 1644 1645 /*- 1646 * Determine whether td may debug p. 1647 * Returns: 0 for permitted, an errno value otherwise 1648 * Locks: Sufficient locks to protect various components of td and p 1649 * must be held. td must be curthread, and a lock must 1650 * be held for p. 1651 * References: td and p must be valid for the lifetime of the call 1652 */ 1653 int 1654 p_candebug(struct thread *td, struct proc *p) 1655 { 1656 int credentialchanged, error, grpsubset, i, uidsubset; 1657 1658 KASSERT(td == curthread, ("%s: td not curthread", __func__)); 1659 PROC_LOCK_ASSERT(p, MA_OWNED); 1660 if (!unprivileged_proc_debug) { 1661 error = priv_check(td, PRIV_DEBUG_UNPRIV); 1662 if (error) 1663 return (error); 1664 } 1665 if (td->td_proc == p) 1666 return (0); 1667 if ((error = prison_check(td->td_ucred, p->p_ucred))) 1668 return (error); 1669 #ifdef MAC 1670 if ((error = mac_proc_check_debug(td->td_ucred, p))) 1671 return (error); 1672 #endif 1673 if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred))) 1674 return (error); 1675 if ((error = cr_canseeothergids(td->td_ucred, p->p_ucred))) 1676 return (error); 1677 1678 /* 1679 * Is p's group set a subset of td's effective group set? This 1680 * includes p's egid, group access list, rgid, and svgid. 1681 */ 1682 grpsubset = 1; 1683 for (i = 0; i < p->p_ucred->cr_ngroups; i++) { 1684 if (!groupmember(p->p_ucred->cr_groups[i], td->td_ucred)) { 1685 grpsubset = 0; 1686 break; 1687 } 1688 } 1689 grpsubset = grpsubset && 1690 groupmember(p->p_ucred->cr_rgid, td->td_ucred) && 1691 groupmember(p->p_ucred->cr_svgid, td->td_ucred); 1692 1693 /* 1694 * Are the uids present in p's credential equal to td's 1695 * effective uid? This includes p's euid, svuid, and ruid. 1696 */ 1697 uidsubset = (td->td_ucred->cr_uid == p->p_ucred->cr_uid && 1698 td->td_ucred->cr_uid == p->p_ucred->cr_svuid && 1699 td->td_ucred->cr_uid == p->p_ucred->cr_ruid); 1700 1701 /* 1702 * Has the credential of the process changed since the last exec()? 1703 */ 1704 credentialchanged = (p->p_flag & P_SUGID); 1705 1706 /* 1707 * If p's gids aren't a subset, or the uids aren't a subset, 1708 * or the credential has changed, require appropriate privilege 1709 * for td to debug p. 1710 */ 1711 if (!grpsubset || !uidsubset) { 1712 error = priv_check(td, PRIV_DEBUG_DIFFCRED); 1713 if (error) 1714 return (error); 1715 } 1716 1717 if (credentialchanged) { 1718 error = priv_check(td, PRIV_DEBUG_SUGID); 1719 if (error) 1720 return (error); 1721 } 1722 1723 /* Can't trace init when securelevel > 0. */ 1724 if (p == initproc) { 1725 error = securelevel_gt(td->td_ucred, 0); 1726 if (error) 1727 return (error); 1728 } 1729 1730 /* 1731 * Can't trace a process that's currently exec'ing. 1732 * 1733 * XXX: Note, this is not a security policy decision, it's a 1734 * basic correctness/functionality decision. Therefore, this check 1735 * should be moved to the caller's of p_candebug(). 1736 */ 1737 if ((p->p_flag & P_INEXEC) != 0) 1738 return (EBUSY); 1739 1740 /* Denied explicitely */ 1741 if ((p->p_flag2 & P2_NOTRACE) != 0) { 1742 error = priv_check(td, PRIV_DEBUG_DENIED); 1743 if (error != 0) 1744 return (error); 1745 } 1746 1747 return (0); 1748 } 1749 1750 /*- 1751 * Determine whether the subject represented by cred can "see" a socket. 1752 * Returns: 0 for permitted, ENOENT otherwise. 1753 */ 1754 int 1755 cr_canseesocket(struct ucred *cred, struct socket *so) 1756 { 1757 int error; 1758 1759 error = prison_check(cred, so->so_cred); 1760 if (error) 1761 return (ENOENT); 1762 #ifdef MAC 1763 error = mac_socket_check_visible(cred, so); 1764 if (error) 1765 return (error); 1766 #endif 1767 if (cr_canseeotheruids(cred, so->so_cred)) 1768 return (ENOENT); 1769 if (cr_canseeothergids(cred, so->so_cred)) 1770 return (ENOENT); 1771 1772 return (0); 1773 } 1774 1775 /*- 1776 * Determine whether td can wait for the exit of p. 1777 * Returns: 0 for permitted, an errno value otherwise 1778 * Locks: Sufficient locks to protect various components of td and p 1779 * must be held. td must be curthread, and a lock must 1780 * be held for p. 1781 * References: td and p must be valid for the lifetime of the call 1782 1783 */ 1784 int 1785 p_canwait(struct thread *td, struct proc *p) 1786 { 1787 int error; 1788 1789 KASSERT(td == curthread, ("%s: td not curthread", __func__)); 1790 PROC_LOCK_ASSERT(p, MA_OWNED); 1791 if ((error = prison_check(td->td_ucred, p->p_ucred))) 1792 return (error); 1793 #ifdef MAC 1794 if ((error = mac_proc_check_wait(td->td_ucred, p))) 1795 return (error); 1796 #endif 1797 #if 0 1798 /* XXXMAC: This could have odd effects on some shells. */ 1799 if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred))) 1800 return (error); 1801 #endif 1802 1803 return (0); 1804 } 1805 1806 /* 1807 * Allocate a zeroed cred structure. 1808 */ 1809 struct ucred * 1810 crget(void) 1811 { 1812 struct ucred *cr; 1813 1814 cr = malloc(sizeof(*cr), M_CRED, M_WAITOK | M_ZERO); 1815 refcount_init(&cr->cr_ref, 1); 1816 #ifdef AUDIT 1817 audit_cred_init(cr); 1818 #endif 1819 #ifdef MAC 1820 mac_cred_init(cr); 1821 #endif 1822 cr->cr_groups = cr->cr_smallgroups; 1823 cr->cr_agroups = 1824 sizeof(cr->cr_smallgroups) / sizeof(cr->cr_smallgroups[0]); 1825 return (cr); 1826 } 1827 1828 /* 1829 * Claim another reference to a ucred structure. 1830 */ 1831 struct ucred * 1832 crhold(struct ucred *cr) 1833 { 1834 1835 refcount_acquire(&cr->cr_ref); 1836 return (cr); 1837 } 1838 1839 /* 1840 * Free a cred structure. Throws away space when ref count gets to 0. 1841 */ 1842 void 1843 crfree(struct ucred *cr) 1844 { 1845 1846 KASSERT(cr->cr_ref > 0, ("bad ucred refcount: %d", cr->cr_ref)); 1847 KASSERT(cr->cr_ref != 0xdeadc0de, ("dangling reference to ucred")); 1848 if (refcount_release(&cr->cr_ref)) { 1849 /* 1850 * Some callers of crget(), such as nfs_statfs(), 1851 * allocate a temporary credential, but don't 1852 * allocate a uidinfo structure. 1853 */ 1854 if (cr->cr_uidinfo != NULL) 1855 uifree(cr->cr_uidinfo); 1856 if (cr->cr_ruidinfo != NULL) 1857 uifree(cr->cr_ruidinfo); 1858 /* 1859 * Free a prison, if any. 1860 */ 1861 if (cr->cr_prison != NULL) 1862 prison_free(cr->cr_prison); 1863 if (cr->cr_loginclass != NULL) 1864 loginclass_free(cr->cr_loginclass); 1865 #ifdef AUDIT 1866 audit_cred_destroy(cr); 1867 #endif 1868 #ifdef MAC 1869 mac_cred_destroy(cr); 1870 #endif 1871 if (cr->cr_groups != cr->cr_smallgroups) 1872 free(cr->cr_groups, M_CRED); 1873 free(cr, M_CRED); 1874 } 1875 } 1876 1877 /* 1878 * Copy a ucred's contents from a template. Does not block. 1879 */ 1880 void 1881 crcopy(struct ucred *dest, struct ucred *src) 1882 { 1883 1884 KASSERT(dest->cr_ref == 1, ("crcopy of shared ucred")); 1885 bcopy(&src->cr_startcopy, &dest->cr_startcopy, 1886 (unsigned)((caddr_t)&src->cr_endcopy - 1887 (caddr_t)&src->cr_startcopy)); 1888 crsetgroups(dest, src->cr_ngroups, src->cr_groups); 1889 uihold(dest->cr_uidinfo); 1890 uihold(dest->cr_ruidinfo); 1891 prison_hold(dest->cr_prison); 1892 loginclass_hold(dest->cr_loginclass); 1893 #ifdef AUDIT 1894 audit_cred_copy(src, dest); 1895 #endif 1896 #ifdef MAC 1897 mac_cred_copy(src, dest); 1898 #endif 1899 } 1900 1901 /* 1902 * Dup cred struct to a new held one. 1903 */ 1904 struct ucred * 1905 crdup(struct ucred *cr) 1906 { 1907 struct ucred *newcr; 1908 1909 newcr = crget(); 1910 crcopy(newcr, cr); 1911 return (newcr); 1912 } 1913 1914 /* 1915 * Fill in a struct xucred based on a struct ucred. 1916 */ 1917 void 1918 cru2x(struct ucred *cr, struct xucred *xcr) 1919 { 1920 int ngroups; 1921 1922 bzero(xcr, sizeof(*xcr)); 1923 xcr->cr_version = XUCRED_VERSION; 1924 xcr->cr_uid = cr->cr_uid; 1925 1926 ngroups = MIN(cr->cr_ngroups, XU_NGROUPS); 1927 xcr->cr_ngroups = ngroups; 1928 bcopy(cr->cr_groups, xcr->cr_groups, 1929 ngroups * sizeof(*cr->cr_groups)); 1930 } 1931 1932 /* 1933 * Set initial process credentials. 1934 * Callers are responsible for providing the reference for provided credentials. 1935 */ 1936 void 1937 proc_set_cred_init(struct proc *p, struct ucred *newcred) 1938 { 1939 1940 p->p_ucred = newcred; 1941 } 1942 1943 /* 1944 * Change process credentials. 1945 * Callers are responsible for providing the reference for passed credentials 1946 * and for freeing old ones. 1947 * 1948 * Process has to be locked except when it does not have credentials (as it 1949 * should not be visible just yet) or when newcred is NULL (as this can be 1950 * only used when the process is about to be freed, at which point it should 1951 * not be visible anymore). 1952 */ 1953 struct ucred * 1954 proc_set_cred(struct proc *p, struct ucred *newcred) 1955 { 1956 struct ucred *oldcred; 1957 1958 MPASS(p->p_ucred != NULL); 1959 if (newcred == NULL) 1960 MPASS(p->p_state == PRS_ZOMBIE); 1961 else 1962 PROC_LOCK_ASSERT(p, MA_OWNED); 1963 1964 oldcred = p->p_ucred; 1965 p->p_ucred = newcred; 1966 if (newcred != NULL) 1967 PROC_UPDATE_COW(p); 1968 return (oldcred); 1969 } 1970 1971 struct ucred * 1972 crcopysafe(struct proc *p, struct ucred *cr) 1973 { 1974 struct ucred *oldcred; 1975 int groups; 1976 1977 PROC_LOCK_ASSERT(p, MA_OWNED); 1978 1979 oldcred = p->p_ucred; 1980 while (cr->cr_agroups < oldcred->cr_agroups) { 1981 groups = oldcred->cr_agroups; 1982 PROC_UNLOCK(p); 1983 crextend(cr, groups); 1984 PROC_LOCK(p); 1985 oldcred = p->p_ucred; 1986 } 1987 crcopy(cr, oldcred); 1988 1989 return (oldcred); 1990 } 1991 1992 /* 1993 * Extend the passed in credential to hold n items. 1994 */ 1995 void 1996 crextend(struct ucred *cr, int n) 1997 { 1998 int cnt; 1999 2000 /* Truncate? */ 2001 if (n <= cr->cr_agroups) 2002 return; 2003 2004 /* 2005 * We extend by 2 each time since we're using a power of two 2006 * allocator until we need enough groups to fill a page. 2007 * Once we're allocating multiple pages, only allocate as many 2008 * as we actually need. The case of processes needing a 2009 * non-power of two number of pages seems more likely than 2010 * a real world process that adds thousands of groups one at a 2011 * time. 2012 */ 2013 if ( n < PAGE_SIZE / sizeof(gid_t) ) { 2014 if (cr->cr_agroups == 0) 2015 cnt = MINALLOCSIZE / sizeof(gid_t); 2016 else 2017 cnt = cr->cr_agroups * 2; 2018 2019 while (cnt < n) 2020 cnt *= 2; 2021 } else 2022 cnt = roundup2(n, PAGE_SIZE / sizeof(gid_t)); 2023 2024 /* Free the old array. */ 2025 if (cr->cr_groups != cr->cr_smallgroups) 2026 free(cr->cr_groups, M_CRED); 2027 2028 cr->cr_groups = malloc(cnt * sizeof(gid_t), M_CRED, M_WAITOK | M_ZERO); 2029 cr->cr_agroups = cnt; 2030 } 2031 2032 /* 2033 * Copy groups in to a credential, preserving any necessary invariants. 2034 * Currently this includes the sorting of all supplemental gids. 2035 * crextend() must have been called before hand to ensure sufficient 2036 * space is available. 2037 */ 2038 static void 2039 crsetgroups_locked(struct ucred *cr, int ngrp, gid_t *groups) 2040 { 2041 int i; 2042 int j; 2043 gid_t g; 2044 2045 KASSERT(cr->cr_agroups >= ngrp, ("cr_ngroups is too small")); 2046 2047 bcopy(groups, cr->cr_groups, ngrp * sizeof(gid_t)); 2048 cr->cr_ngroups = ngrp; 2049 2050 /* 2051 * Sort all groups except cr_groups[0] to allow groupmember to 2052 * perform a binary search. 2053 * 2054 * XXX: If large numbers of groups become common this should 2055 * be replaced with shell sort like linux uses or possibly 2056 * heap sort. 2057 */ 2058 for (i = 2; i < ngrp; i++) { 2059 g = cr->cr_groups[i]; 2060 for (j = i-1; j >= 1 && g < cr->cr_groups[j]; j--) 2061 cr->cr_groups[j + 1] = cr->cr_groups[j]; 2062 cr->cr_groups[j + 1] = g; 2063 } 2064 } 2065 2066 /* 2067 * Copy groups in to a credential after expanding it if required. 2068 * Truncate the list to (ngroups_max + 1) if it is too large. 2069 */ 2070 void 2071 crsetgroups(struct ucred *cr, int ngrp, gid_t *groups) 2072 { 2073 2074 if (ngrp > ngroups_max + 1) 2075 ngrp = ngroups_max + 1; 2076 2077 crextend(cr, ngrp); 2078 crsetgroups_locked(cr, ngrp, groups); 2079 } 2080 2081 /* 2082 * Get login name, if available. 2083 */ 2084 #ifndef _SYS_SYSPROTO_H_ 2085 struct getlogin_args { 2086 char *namebuf; 2087 u_int namelen; 2088 }; 2089 #endif 2090 /* ARGSUSED */ 2091 int 2092 sys_getlogin(struct thread *td, struct getlogin_args *uap) 2093 { 2094 char login[MAXLOGNAME]; 2095 struct proc *p = td->td_proc; 2096 size_t len; 2097 2098 if (uap->namelen > MAXLOGNAME) 2099 uap->namelen = MAXLOGNAME; 2100 PROC_LOCK(p); 2101 SESS_LOCK(p->p_session); 2102 len = strlcpy(login, p->p_session->s_login, uap->namelen) + 1; 2103 SESS_UNLOCK(p->p_session); 2104 PROC_UNLOCK(p); 2105 if (len > uap->namelen) 2106 return (ERANGE); 2107 return (copyout(login, uap->namebuf, len)); 2108 } 2109 2110 /* 2111 * Set login name. 2112 */ 2113 #ifndef _SYS_SYSPROTO_H_ 2114 struct setlogin_args { 2115 char *namebuf; 2116 }; 2117 #endif 2118 /* ARGSUSED */ 2119 int 2120 sys_setlogin(struct thread *td, struct setlogin_args *uap) 2121 { 2122 struct proc *p = td->td_proc; 2123 int error; 2124 char logintmp[MAXLOGNAME]; 2125 2126 CTASSERT(sizeof(p->p_session->s_login) >= sizeof(logintmp)); 2127 2128 error = priv_check(td, PRIV_PROC_SETLOGIN); 2129 if (error) 2130 return (error); 2131 error = copyinstr(uap->namebuf, logintmp, sizeof(logintmp), NULL); 2132 if (error != 0) { 2133 if (error == ENAMETOOLONG) 2134 error = EINVAL; 2135 return (error); 2136 } 2137 AUDIT_ARG_LOGIN(logintmp); 2138 PROC_LOCK(p); 2139 SESS_LOCK(p->p_session); 2140 strcpy(p->p_session->s_login, logintmp); 2141 SESS_UNLOCK(p->p_session); 2142 PROC_UNLOCK(p); 2143 return (0); 2144 } 2145 2146 void 2147 setsugid(struct proc *p) 2148 { 2149 2150 PROC_LOCK_ASSERT(p, MA_OWNED); 2151 p->p_flag |= P_SUGID; 2152 if (!(p->p_pfsflags & PF_ISUGID)) 2153 p->p_stops = 0; 2154 } 2155 2156 /*- 2157 * Change a process's effective uid. 2158 * Side effects: newcred->cr_uid and newcred->cr_uidinfo will be modified. 2159 * References: newcred must be an exclusive credential reference for the 2160 * duration of the call. 2161 */ 2162 void 2163 change_euid(struct ucred *newcred, struct uidinfo *euip) 2164 { 2165 2166 newcred->cr_uid = euip->ui_uid; 2167 uihold(euip); 2168 uifree(newcred->cr_uidinfo); 2169 newcred->cr_uidinfo = euip; 2170 } 2171 2172 /*- 2173 * Change a process's effective gid. 2174 * Side effects: newcred->cr_gid will be modified. 2175 * References: newcred must be an exclusive credential reference for the 2176 * duration of the call. 2177 */ 2178 void 2179 change_egid(struct ucred *newcred, gid_t egid) 2180 { 2181 2182 newcred->cr_groups[0] = egid; 2183 } 2184 2185 /*- 2186 * Change a process's real uid. 2187 * Side effects: newcred->cr_ruid will be updated, newcred->cr_ruidinfo 2188 * will be updated, and the old and new cr_ruidinfo proc 2189 * counts will be updated. 2190 * References: newcred must be an exclusive credential reference for the 2191 * duration of the call. 2192 */ 2193 void 2194 change_ruid(struct ucred *newcred, struct uidinfo *ruip) 2195 { 2196 2197 (void)chgproccnt(newcred->cr_ruidinfo, -1, 0); 2198 newcred->cr_ruid = ruip->ui_uid; 2199 uihold(ruip); 2200 uifree(newcred->cr_ruidinfo); 2201 newcred->cr_ruidinfo = ruip; 2202 (void)chgproccnt(newcred->cr_ruidinfo, 1, 0); 2203 } 2204 2205 /*- 2206 * Change a process's real gid. 2207 * Side effects: newcred->cr_rgid will be updated. 2208 * References: newcred must be an exclusive credential reference for the 2209 * duration of the call. 2210 */ 2211 void 2212 change_rgid(struct ucred *newcred, gid_t rgid) 2213 { 2214 2215 newcred->cr_rgid = rgid; 2216 } 2217 2218 /*- 2219 * Change a process's saved uid. 2220 * Side effects: newcred->cr_svuid will be updated. 2221 * References: newcred must be an exclusive credential reference for the 2222 * duration of the call. 2223 */ 2224 void 2225 change_svuid(struct ucred *newcred, uid_t svuid) 2226 { 2227 2228 newcred->cr_svuid = svuid; 2229 } 2230 2231 /*- 2232 * Change a process's saved gid. 2233 * Side effects: newcred->cr_svgid will be updated. 2234 * References: newcred must be an exclusive credential reference for the 2235 * duration of the call. 2236 */ 2237 void 2238 change_svgid(struct ucred *newcred, gid_t svgid) 2239 { 2240 2241 newcred->cr_svgid = svgid; 2242 } 2243