xref: /freebsd/sys/kern/kern_prot.c (revision af23369a6deaaeb612ab266eb88b8bb8d560c322)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1989, 1990, 1991, 1993
5  *	The Regents of the University of California.
6  * (c) UNIX System Laboratories, Inc.
7  * Copyright (c) 2000-2001 Robert N. M. Watson.
8  * All rights reserved.
9  *
10  * All or some portions of this file are derived from material licensed
11  * to the University of California by American Telephone and Telegraph
12  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
13  * the permission of UNIX System Laboratories, Inc.
14  *
15  * Redistribution and use in source and binary forms, with or without
16  * modification, are permitted provided that the following conditions
17  * are met:
18  * 1. Redistributions of source code must retain the above copyright
19  *    notice, this list of conditions and the following disclaimer.
20  * 2. Redistributions in binary form must reproduce the above copyright
21  *    notice, this list of conditions and the following disclaimer in the
22  *    documentation and/or other materials provided with the distribution.
23  * 3. Neither the name of the University nor the names of its contributors
24  *    may be used to endorse or promote products derived from this software
25  *    without specific prior written permission.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
28  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
29  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
30  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
31  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
32  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
33  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
34  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
35  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
36  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37  * SUCH DAMAGE.
38  *
39  *	@(#)kern_prot.c	8.6 (Berkeley) 1/21/94
40  */
41 
42 /*
43  * System calls related to processes and protection
44  */
45 
46 #include <sys/cdefs.h>
47 __FBSDID("$FreeBSD$");
48 
49 #include "opt_inet.h"
50 #include "opt_inet6.h"
51 
52 #include <sys/param.h>
53 #include <sys/systm.h>
54 #include <sys/acct.h>
55 #include <sys/kdb.h>
56 #include <sys/kernel.h>
57 #include <sys/lock.h>
58 #include <sys/loginclass.h>
59 #include <sys/malloc.h>
60 #include <sys/mutex.h>
61 #include <sys/ptrace.h>
62 #include <sys/refcount.h>
63 #include <sys/sx.h>
64 #include <sys/priv.h>
65 #include <sys/proc.h>
66 #ifdef COMPAT_43
67 #include <sys/sysent.h>
68 #endif
69 #include <sys/sysproto.h>
70 #include <sys/jail.h>
71 #include <sys/racct.h>
72 #include <sys/rctl.h>
73 #include <sys/resourcevar.h>
74 #include <sys/socket.h>
75 #include <sys/socketvar.h>
76 #include <sys/syscallsubr.h>
77 #include <sys/sysctl.h>
78 
79 #ifdef REGRESSION
80 FEATURE(regression,
81     "Kernel support for interfaces necessary for regression testing (SECURITY RISK!)");
82 #endif
83 
84 #include <security/audit/audit.h>
85 #include <security/mac/mac_framework.h>
86 
87 static MALLOC_DEFINE(M_CRED, "cred", "credentials");
88 
89 SYSCTL_NODE(_security, OID_AUTO, bsd, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
90     "BSD security policy");
91 
92 static void crfree_final(struct ucred *cr);
93 static void crsetgroups_locked(struct ucred *cr, int ngrp,
94     gid_t *groups);
95 
96 #ifndef _SYS_SYSPROTO_H_
97 struct getpid_args {
98 	int	dummy;
99 };
100 #endif
101 /* ARGSUSED */
102 int
103 sys_getpid(struct thread *td, struct getpid_args *uap)
104 {
105 	struct proc *p = td->td_proc;
106 
107 	td->td_retval[0] = p->p_pid;
108 #if defined(COMPAT_43)
109 	if (SV_PROC_FLAG(p, SV_AOUT))
110 		td->td_retval[1] = kern_getppid(td);
111 #endif
112 	return (0);
113 }
114 
115 #ifndef _SYS_SYSPROTO_H_
116 struct getppid_args {
117         int     dummy;
118 };
119 #endif
120 /* ARGSUSED */
121 int
122 sys_getppid(struct thread *td, struct getppid_args *uap)
123 {
124 
125 	td->td_retval[0] = kern_getppid(td);
126 	return (0);
127 }
128 
129 int
130 kern_getppid(struct thread *td)
131 {
132 	struct proc *p = td->td_proc;
133 
134 	return (p->p_oppid);
135 }
136 
137 /*
138  * Get process group ID; note that POSIX getpgrp takes no parameter.
139  */
140 #ifndef _SYS_SYSPROTO_H_
141 struct getpgrp_args {
142         int     dummy;
143 };
144 #endif
145 int
146 sys_getpgrp(struct thread *td, struct getpgrp_args *uap)
147 {
148 	struct proc *p = td->td_proc;
149 
150 	PROC_LOCK(p);
151 	td->td_retval[0] = p->p_pgrp->pg_id;
152 	PROC_UNLOCK(p);
153 	return (0);
154 }
155 
156 /* Get an arbitrary pid's process group id */
157 #ifndef _SYS_SYSPROTO_H_
158 struct getpgid_args {
159 	pid_t	pid;
160 };
161 #endif
162 int
163 sys_getpgid(struct thread *td, struct getpgid_args *uap)
164 {
165 	struct proc *p;
166 	int error;
167 
168 	if (uap->pid == 0) {
169 		p = td->td_proc;
170 		PROC_LOCK(p);
171 	} else {
172 		p = pfind(uap->pid);
173 		if (p == NULL)
174 			return (ESRCH);
175 		error = p_cansee(td, p);
176 		if (error) {
177 			PROC_UNLOCK(p);
178 			return (error);
179 		}
180 	}
181 	td->td_retval[0] = p->p_pgrp->pg_id;
182 	PROC_UNLOCK(p);
183 	return (0);
184 }
185 
186 /*
187  * Get an arbitrary pid's session id.
188  */
189 #ifndef _SYS_SYSPROTO_H_
190 struct getsid_args {
191 	pid_t	pid;
192 };
193 #endif
194 int
195 sys_getsid(struct thread *td, struct getsid_args *uap)
196 {
197 
198 	return (kern_getsid(td, uap->pid));
199 }
200 
201 int
202 kern_getsid(struct thread *td, pid_t pid)
203 {
204 	struct proc *p;
205 	int error;
206 
207 	if (pid == 0) {
208 		p = td->td_proc;
209 		PROC_LOCK(p);
210 	} else {
211 		p = pfind(pid);
212 		if (p == NULL)
213 			return (ESRCH);
214 		error = p_cansee(td, p);
215 		if (error) {
216 			PROC_UNLOCK(p);
217 			return (error);
218 		}
219 	}
220 	td->td_retval[0] = p->p_session->s_sid;
221 	PROC_UNLOCK(p);
222 	return (0);
223 }
224 
225 #ifndef _SYS_SYSPROTO_H_
226 struct getuid_args {
227         int     dummy;
228 };
229 #endif
230 /* ARGSUSED */
231 int
232 sys_getuid(struct thread *td, struct getuid_args *uap)
233 {
234 
235 	td->td_retval[0] = td->td_ucred->cr_ruid;
236 #if defined(COMPAT_43)
237 	td->td_retval[1] = td->td_ucred->cr_uid;
238 #endif
239 	return (0);
240 }
241 
242 #ifndef _SYS_SYSPROTO_H_
243 struct geteuid_args {
244         int     dummy;
245 };
246 #endif
247 /* ARGSUSED */
248 int
249 sys_geteuid(struct thread *td, struct geteuid_args *uap)
250 {
251 
252 	td->td_retval[0] = td->td_ucred->cr_uid;
253 	return (0);
254 }
255 
256 #ifndef _SYS_SYSPROTO_H_
257 struct getgid_args {
258         int     dummy;
259 };
260 #endif
261 /* ARGSUSED */
262 int
263 sys_getgid(struct thread *td, struct getgid_args *uap)
264 {
265 
266 	td->td_retval[0] = td->td_ucred->cr_rgid;
267 #if defined(COMPAT_43)
268 	td->td_retval[1] = td->td_ucred->cr_groups[0];
269 #endif
270 	return (0);
271 }
272 
273 /*
274  * Get effective group ID.  The "egid" is groups[0], and could be obtained
275  * via getgroups.  This syscall exists because it is somewhat painful to do
276  * correctly in a library function.
277  */
278 #ifndef _SYS_SYSPROTO_H_
279 struct getegid_args {
280         int     dummy;
281 };
282 #endif
283 /* ARGSUSED */
284 int
285 sys_getegid(struct thread *td, struct getegid_args *uap)
286 {
287 
288 	td->td_retval[0] = td->td_ucred->cr_groups[0];
289 	return (0);
290 }
291 
292 #ifndef _SYS_SYSPROTO_H_
293 struct getgroups_args {
294 	int	gidsetsize;
295 	gid_t	*gidset;
296 };
297 #endif
298 int
299 sys_getgroups(struct thread *td, struct getgroups_args *uap)
300 {
301 	struct ucred *cred;
302 	int ngrp, error;
303 
304 	cred = td->td_ucred;
305 	ngrp = cred->cr_ngroups;
306 
307 	if (uap->gidsetsize == 0) {
308 		error = 0;
309 		goto out;
310 	}
311 	if (uap->gidsetsize < ngrp)
312 		return (EINVAL);
313 
314 	error = copyout(cred->cr_groups, uap->gidset, ngrp * sizeof(gid_t));
315 out:
316 	td->td_retval[0] = ngrp;
317 	return (error);
318 }
319 
320 #ifndef _SYS_SYSPROTO_H_
321 struct setsid_args {
322         int     dummy;
323 };
324 #endif
325 /* ARGSUSED */
326 int
327 sys_setsid(struct thread *td, struct setsid_args *uap)
328 {
329 	struct pgrp *pgrp;
330 	int error;
331 	struct proc *p = td->td_proc;
332 	struct pgrp *newpgrp;
333 	struct session *newsess;
334 
335 	error = 0;
336 	pgrp = NULL;
337 
338 	newpgrp = uma_zalloc(pgrp_zone, M_WAITOK);
339 	newsess = malloc(sizeof(struct session), M_SESSION, M_WAITOK | M_ZERO);
340 
341 	sx_xlock(&proctree_lock);
342 
343 	if (p->p_pgid == p->p_pid || (pgrp = pgfind(p->p_pid)) != NULL) {
344 		if (pgrp != NULL)
345 			PGRP_UNLOCK(pgrp);
346 		error = EPERM;
347 	} else {
348 		(void)enterpgrp(p, p->p_pid, newpgrp, newsess);
349 		td->td_retval[0] = p->p_pid;
350 		newpgrp = NULL;
351 		newsess = NULL;
352 	}
353 
354 	sx_xunlock(&proctree_lock);
355 
356 	uma_zfree(pgrp_zone, newpgrp);
357 	free(newsess, M_SESSION);
358 
359 	return (error);
360 }
361 
362 /*
363  * set process group (setpgid/old setpgrp)
364  *
365  * caller does setpgid(targpid, targpgid)
366  *
367  * pid must be caller or child of caller (ESRCH)
368  * if a child
369  *	pid must be in same session (EPERM)
370  *	pid can't have done an exec (EACCES)
371  * if pgid != pid
372  * 	there must exist some pid in same session having pgid (EPERM)
373  * pid must not be session leader (EPERM)
374  */
375 #ifndef _SYS_SYSPROTO_H_
376 struct setpgid_args {
377 	int	pid;		/* target process id */
378 	int	pgid;		/* target pgrp id */
379 };
380 #endif
381 /* ARGSUSED */
382 int
383 sys_setpgid(struct thread *td, struct setpgid_args *uap)
384 {
385 	struct proc *curp = td->td_proc;
386 	struct proc *targp;	/* target process */
387 	struct pgrp *pgrp;	/* target pgrp */
388 	int error;
389 	struct pgrp *newpgrp;
390 
391 	if (uap->pgid < 0)
392 		return (EINVAL);
393 
394 	error = 0;
395 
396 	newpgrp = uma_zalloc(pgrp_zone, M_WAITOK);
397 
398 	sx_xlock(&proctree_lock);
399 	if (uap->pid != 0 && uap->pid != curp->p_pid) {
400 		if ((targp = pfind(uap->pid)) == NULL) {
401 			error = ESRCH;
402 			goto done;
403 		}
404 		if (!inferior(targp)) {
405 			PROC_UNLOCK(targp);
406 			error = ESRCH;
407 			goto done;
408 		}
409 		if ((error = p_cansee(td, targp))) {
410 			PROC_UNLOCK(targp);
411 			goto done;
412 		}
413 		if (targp->p_pgrp == NULL ||
414 		    targp->p_session != curp->p_session) {
415 			PROC_UNLOCK(targp);
416 			error = EPERM;
417 			goto done;
418 		}
419 		if (targp->p_flag & P_EXEC) {
420 			PROC_UNLOCK(targp);
421 			error = EACCES;
422 			goto done;
423 		}
424 		PROC_UNLOCK(targp);
425 	} else
426 		targp = curp;
427 	if (SESS_LEADER(targp)) {
428 		error = EPERM;
429 		goto done;
430 	}
431 	if (uap->pgid == 0)
432 		uap->pgid = targp->p_pid;
433 	if ((pgrp = pgfind(uap->pgid)) == NULL) {
434 		if (uap->pgid == targp->p_pid) {
435 			error = enterpgrp(targp, uap->pgid, newpgrp,
436 			    NULL);
437 			if (error == 0)
438 				newpgrp = NULL;
439 		} else
440 			error = EPERM;
441 	} else {
442 		if (pgrp == targp->p_pgrp) {
443 			PGRP_UNLOCK(pgrp);
444 			goto done;
445 		}
446 		if (pgrp->pg_id != targp->p_pid &&
447 		    pgrp->pg_session != curp->p_session) {
448 			PGRP_UNLOCK(pgrp);
449 			error = EPERM;
450 			goto done;
451 		}
452 		PGRP_UNLOCK(pgrp);
453 		error = enterthispgrp(targp, pgrp);
454 	}
455 done:
456 	sx_xunlock(&proctree_lock);
457 	KASSERT((error == 0) || (newpgrp != NULL),
458 	    ("setpgid failed and newpgrp is NULL"));
459 	uma_zfree(pgrp_zone, newpgrp);
460 	return (error);
461 }
462 
463 /*
464  * Use the clause in B.4.2.2 that allows setuid/setgid to be 4.2/4.3BSD
465  * compatible.  It says that setting the uid/gid to euid/egid is a special
466  * case of "appropriate privilege".  Once the rules are expanded out, this
467  * basically means that setuid(nnn) sets all three id's, in all permitted
468  * cases unless _POSIX_SAVED_IDS is enabled.  In that case, setuid(getuid())
469  * does not set the saved id - this is dangerous for traditional BSD
470  * programs.  For this reason, we *really* do not want to set
471  * _POSIX_SAVED_IDS and do not want to clear POSIX_APPENDIX_B_4_2_2.
472  */
473 #define POSIX_APPENDIX_B_4_2_2
474 
475 #ifndef _SYS_SYSPROTO_H_
476 struct setuid_args {
477 	uid_t	uid;
478 };
479 #endif
480 /* ARGSUSED */
481 int
482 sys_setuid(struct thread *td, struct setuid_args *uap)
483 {
484 	struct proc *p = td->td_proc;
485 	struct ucred *newcred, *oldcred;
486 	uid_t uid;
487 	struct uidinfo *uip;
488 	int error;
489 
490 	uid = uap->uid;
491 	AUDIT_ARG_UID(uid);
492 	newcred = crget();
493 	uip = uifind(uid);
494 	PROC_LOCK(p);
495 	/*
496 	 * Copy credentials so other references do not see our changes.
497 	 */
498 	oldcred = crcopysafe(p, newcred);
499 
500 #ifdef MAC
501 	error = mac_cred_check_setuid(oldcred, uid);
502 	if (error)
503 		goto fail;
504 #endif
505 
506 	/*
507 	 * See if we have "permission" by POSIX 1003.1 rules.
508 	 *
509 	 * Note that setuid(geteuid()) is a special case of
510 	 * "appropriate privileges" in appendix B.4.2.2.  We need
511 	 * to use this clause to be compatible with traditional BSD
512 	 * semantics.  Basically, it means that "setuid(xx)" sets all
513 	 * three id's (assuming you have privs).
514 	 *
515 	 * Notes on the logic.  We do things in three steps.
516 	 * 1: We determine if the euid is going to change, and do EPERM
517 	 *    right away.  We unconditionally change the euid later if this
518 	 *    test is satisfied, simplifying that part of the logic.
519 	 * 2: We determine if the real and/or saved uids are going to
520 	 *    change.  Determined by compile options.
521 	 * 3: Change euid last. (after tests in #2 for "appropriate privs")
522 	 */
523 	if (uid != oldcred->cr_ruid &&		/* allow setuid(getuid()) */
524 #ifdef _POSIX_SAVED_IDS
525 	    uid != oldcred->cr_svuid &&		/* allow setuid(saved gid) */
526 #endif
527 #ifdef POSIX_APPENDIX_B_4_2_2	/* Use BSD-compat clause from B.4.2.2 */
528 	    uid != oldcred->cr_uid &&		/* allow setuid(geteuid()) */
529 #endif
530 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETUID)) != 0)
531 		goto fail;
532 
533 #ifdef _POSIX_SAVED_IDS
534 	/*
535 	 * Do we have "appropriate privileges" (are we root or uid == euid)
536 	 * If so, we are changing the real uid and/or saved uid.
537 	 */
538 	if (
539 #ifdef POSIX_APPENDIX_B_4_2_2	/* Use the clause from B.4.2.2 */
540 	    uid == oldcred->cr_uid ||
541 #endif
542 	    /* We are using privs. */
543 	    priv_check_cred(oldcred, PRIV_CRED_SETUID) == 0)
544 #endif
545 	{
546 		/*
547 		 * Set the real uid and transfer proc count to new user.
548 		 */
549 		if (uid != oldcred->cr_ruid) {
550 			change_ruid(newcred, uip);
551 			setsugid(p);
552 		}
553 		/*
554 		 * Set saved uid
555 		 *
556 		 * XXX always set saved uid even if not _POSIX_SAVED_IDS, as
557 		 * the security of seteuid() depends on it.  B.4.2.2 says it
558 		 * is important that we should do this.
559 		 */
560 		if (uid != oldcred->cr_svuid) {
561 			change_svuid(newcred, uid);
562 			setsugid(p);
563 		}
564 	}
565 
566 	/*
567 	 * In all permitted cases, we are changing the euid.
568 	 */
569 	if (uid != oldcred->cr_uid) {
570 		change_euid(newcred, uip);
571 		setsugid(p);
572 	}
573 	proc_set_cred(p, newcred);
574 #ifdef RACCT
575 	racct_proc_ucred_changed(p, oldcred, newcred);
576 	crhold(newcred);
577 #endif
578 	PROC_UNLOCK(p);
579 #ifdef RCTL
580 	rctl_proc_ucred_changed(p, newcred);
581 	crfree(newcred);
582 #endif
583 	uifree(uip);
584 	crfree(oldcred);
585 	return (0);
586 
587 fail:
588 	PROC_UNLOCK(p);
589 	uifree(uip);
590 	crfree(newcred);
591 	return (error);
592 }
593 
594 #ifndef _SYS_SYSPROTO_H_
595 struct seteuid_args {
596 	uid_t	euid;
597 };
598 #endif
599 /* ARGSUSED */
600 int
601 sys_seteuid(struct thread *td, struct seteuid_args *uap)
602 {
603 	struct proc *p = td->td_proc;
604 	struct ucred *newcred, *oldcred;
605 	uid_t euid;
606 	struct uidinfo *euip;
607 	int error;
608 
609 	euid = uap->euid;
610 	AUDIT_ARG_EUID(euid);
611 	newcred = crget();
612 	euip = uifind(euid);
613 	PROC_LOCK(p);
614 	/*
615 	 * Copy credentials so other references do not see our changes.
616 	 */
617 	oldcred = crcopysafe(p, newcred);
618 
619 #ifdef MAC
620 	error = mac_cred_check_seteuid(oldcred, euid);
621 	if (error)
622 		goto fail;
623 #endif
624 
625 	if (euid != oldcred->cr_ruid &&		/* allow seteuid(getuid()) */
626 	    euid != oldcred->cr_svuid &&	/* allow seteuid(saved uid) */
627 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETEUID)) != 0)
628 		goto fail;
629 
630 	/*
631 	 * Everything's okay, do it.
632 	 */
633 	if (oldcred->cr_uid != euid) {
634 		change_euid(newcred, euip);
635 		setsugid(p);
636 	}
637 	proc_set_cred(p, newcred);
638 	PROC_UNLOCK(p);
639 	uifree(euip);
640 	crfree(oldcred);
641 	return (0);
642 
643 fail:
644 	PROC_UNLOCK(p);
645 	uifree(euip);
646 	crfree(newcred);
647 	return (error);
648 }
649 
650 #ifndef _SYS_SYSPROTO_H_
651 struct setgid_args {
652 	gid_t	gid;
653 };
654 #endif
655 /* ARGSUSED */
656 int
657 sys_setgid(struct thread *td, struct setgid_args *uap)
658 {
659 	struct proc *p = td->td_proc;
660 	struct ucred *newcred, *oldcred;
661 	gid_t gid;
662 	int error;
663 
664 	gid = uap->gid;
665 	AUDIT_ARG_GID(gid);
666 	newcred = crget();
667 	PROC_LOCK(p);
668 	oldcred = crcopysafe(p, newcred);
669 
670 #ifdef MAC
671 	error = mac_cred_check_setgid(oldcred, gid);
672 	if (error)
673 		goto fail;
674 #endif
675 
676 	/*
677 	 * See if we have "permission" by POSIX 1003.1 rules.
678 	 *
679 	 * Note that setgid(getegid()) is a special case of
680 	 * "appropriate privileges" in appendix B.4.2.2.  We need
681 	 * to use this clause to be compatible with traditional BSD
682 	 * semantics.  Basically, it means that "setgid(xx)" sets all
683 	 * three id's (assuming you have privs).
684 	 *
685 	 * For notes on the logic here, see setuid() above.
686 	 */
687 	if (gid != oldcred->cr_rgid &&		/* allow setgid(getgid()) */
688 #ifdef _POSIX_SAVED_IDS
689 	    gid != oldcred->cr_svgid &&		/* allow setgid(saved gid) */
690 #endif
691 #ifdef POSIX_APPENDIX_B_4_2_2	/* Use BSD-compat clause from B.4.2.2 */
692 	    gid != oldcred->cr_groups[0] && /* allow setgid(getegid()) */
693 #endif
694 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETGID)) != 0)
695 		goto fail;
696 
697 #ifdef _POSIX_SAVED_IDS
698 	/*
699 	 * Do we have "appropriate privileges" (are we root or gid == egid)
700 	 * If so, we are changing the real uid and saved gid.
701 	 */
702 	if (
703 #ifdef POSIX_APPENDIX_B_4_2_2	/* use the clause from B.4.2.2 */
704 	    gid == oldcred->cr_groups[0] ||
705 #endif
706 	    /* We are using privs. */
707 	    priv_check_cred(oldcred, PRIV_CRED_SETGID) == 0)
708 #endif
709 	{
710 		/*
711 		 * Set real gid
712 		 */
713 		if (oldcred->cr_rgid != gid) {
714 			change_rgid(newcred, gid);
715 			setsugid(p);
716 		}
717 		/*
718 		 * Set saved gid
719 		 *
720 		 * XXX always set saved gid even if not _POSIX_SAVED_IDS, as
721 		 * the security of setegid() depends on it.  B.4.2.2 says it
722 		 * is important that we should do this.
723 		 */
724 		if (oldcred->cr_svgid != gid) {
725 			change_svgid(newcred, gid);
726 			setsugid(p);
727 		}
728 	}
729 	/*
730 	 * In all cases permitted cases, we are changing the egid.
731 	 * Copy credentials so other references do not see our changes.
732 	 */
733 	if (oldcred->cr_groups[0] != gid) {
734 		change_egid(newcred, gid);
735 		setsugid(p);
736 	}
737 	proc_set_cred(p, newcred);
738 	PROC_UNLOCK(p);
739 	crfree(oldcred);
740 	return (0);
741 
742 fail:
743 	PROC_UNLOCK(p);
744 	crfree(newcred);
745 	return (error);
746 }
747 
748 #ifndef _SYS_SYSPROTO_H_
749 struct setegid_args {
750 	gid_t	egid;
751 };
752 #endif
753 /* ARGSUSED */
754 int
755 sys_setegid(struct thread *td, struct setegid_args *uap)
756 {
757 	struct proc *p = td->td_proc;
758 	struct ucred *newcred, *oldcred;
759 	gid_t egid;
760 	int error;
761 
762 	egid = uap->egid;
763 	AUDIT_ARG_EGID(egid);
764 	newcred = crget();
765 	PROC_LOCK(p);
766 	oldcred = crcopysafe(p, newcred);
767 
768 #ifdef MAC
769 	error = mac_cred_check_setegid(oldcred, egid);
770 	if (error)
771 		goto fail;
772 #endif
773 
774 	if (egid != oldcred->cr_rgid &&		/* allow setegid(getgid()) */
775 	    egid != oldcred->cr_svgid &&	/* allow setegid(saved gid) */
776 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETEGID)) != 0)
777 		goto fail;
778 
779 	if (oldcred->cr_groups[0] != egid) {
780 		change_egid(newcred, egid);
781 		setsugid(p);
782 	}
783 	proc_set_cred(p, newcred);
784 	PROC_UNLOCK(p);
785 	crfree(oldcred);
786 	return (0);
787 
788 fail:
789 	PROC_UNLOCK(p);
790 	crfree(newcred);
791 	return (error);
792 }
793 
794 #ifndef _SYS_SYSPROTO_H_
795 struct setgroups_args {
796 	int	gidsetsize;
797 	gid_t	*gidset;
798 };
799 #endif
800 /* ARGSUSED */
801 int
802 sys_setgroups(struct thread *td, struct setgroups_args *uap)
803 {
804 	gid_t smallgroups[XU_NGROUPS];
805 	gid_t *groups;
806 	int gidsetsize, error;
807 
808 	gidsetsize = uap->gidsetsize;
809 	if (gidsetsize > ngroups_max + 1 || gidsetsize < 0)
810 		return (EINVAL);
811 
812 	if (gidsetsize > XU_NGROUPS)
813 		groups = malloc(gidsetsize * sizeof(gid_t), M_TEMP, M_WAITOK);
814 	else
815 		groups = smallgroups;
816 
817 	error = copyin(uap->gidset, groups, gidsetsize * sizeof(gid_t));
818 	if (error == 0)
819 		error = kern_setgroups(td, gidsetsize, groups);
820 
821 	if (gidsetsize > XU_NGROUPS)
822 		free(groups, M_TEMP);
823 	return (error);
824 }
825 
826 int
827 kern_setgroups(struct thread *td, u_int ngrp, gid_t *groups)
828 {
829 	struct proc *p = td->td_proc;
830 	struct ucred *newcred, *oldcred;
831 	int error;
832 
833 	MPASS(ngrp <= ngroups_max + 1);
834 	AUDIT_ARG_GROUPSET(groups, ngrp);
835 	newcred = crget();
836 	crextend(newcred, ngrp);
837 	PROC_LOCK(p);
838 	oldcred = crcopysafe(p, newcred);
839 
840 #ifdef MAC
841 	error = mac_cred_check_setgroups(oldcred, ngrp, groups);
842 	if (error)
843 		goto fail;
844 #endif
845 
846 	error = priv_check_cred(oldcred, PRIV_CRED_SETGROUPS);
847 	if (error)
848 		goto fail;
849 
850 	if (ngrp == 0) {
851 		/*
852 		 * setgroups(0, NULL) is a legitimate way of clearing the
853 		 * groups vector on non-BSD systems (which generally do not
854 		 * have the egid in the groups[0]).  We risk security holes
855 		 * when running non-BSD software if we do not do the same.
856 		 */
857 		newcred->cr_ngroups = 1;
858 	} else {
859 		crsetgroups_locked(newcred, ngrp, groups);
860 	}
861 	setsugid(p);
862 	proc_set_cred(p, newcred);
863 	PROC_UNLOCK(p);
864 	crfree(oldcred);
865 	return (0);
866 
867 fail:
868 	PROC_UNLOCK(p);
869 	crfree(newcred);
870 	return (error);
871 }
872 
873 #ifndef _SYS_SYSPROTO_H_
874 struct setreuid_args {
875 	uid_t	ruid;
876 	uid_t	euid;
877 };
878 #endif
879 /* ARGSUSED */
880 int
881 sys_setreuid(struct thread *td, struct setreuid_args *uap)
882 {
883 	struct proc *p = td->td_proc;
884 	struct ucred *newcred, *oldcred;
885 	uid_t euid, ruid;
886 	struct uidinfo *euip, *ruip;
887 	int error;
888 
889 	euid = uap->euid;
890 	ruid = uap->ruid;
891 	AUDIT_ARG_EUID(euid);
892 	AUDIT_ARG_RUID(ruid);
893 	newcred = crget();
894 	euip = uifind(euid);
895 	ruip = uifind(ruid);
896 	PROC_LOCK(p);
897 	oldcred = crcopysafe(p, newcred);
898 
899 #ifdef MAC
900 	error = mac_cred_check_setreuid(oldcred, ruid, euid);
901 	if (error)
902 		goto fail;
903 #endif
904 
905 	if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid &&
906 	      ruid != oldcred->cr_svuid) ||
907 	     (euid != (uid_t)-1 && euid != oldcred->cr_uid &&
908 	      euid != oldcred->cr_ruid && euid != oldcred->cr_svuid)) &&
909 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETREUID)) != 0)
910 		goto fail;
911 
912 	if (euid != (uid_t)-1 && oldcred->cr_uid != euid) {
913 		change_euid(newcred, euip);
914 		setsugid(p);
915 	}
916 	if (ruid != (uid_t)-1 && oldcred->cr_ruid != ruid) {
917 		change_ruid(newcred, ruip);
918 		setsugid(p);
919 	}
920 	if ((ruid != (uid_t)-1 || newcred->cr_uid != newcred->cr_ruid) &&
921 	    newcred->cr_svuid != newcred->cr_uid) {
922 		change_svuid(newcred, newcred->cr_uid);
923 		setsugid(p);
924 	}
925 	proc_set_cred(p, newcred);
926 #ifdef RACCT
927 	racct_proc_ucred_changed(p, oldcred, newcred);
928 	crhold(newcred);
929 #endif
930 	PROC_UNLOCK(p);
931 #ifdef RCTL
932 	rctl_proc_ucred_changed(p, newcred);
933 	crfree(newcred);
934 #endif
935 	uifree(ruip);
936 	uifree(euip);
937 	crfree(oldcred);
938 	return (0);
939 
940 fail:
941 	PROC_UNLOCK(p);
942 	uifree(ruip);
943 	uifree(euip);
944 	crfree(newcred);
945 	return (error);
946 }
947 
948 #ifndef _SYS_SYSPROTO_H_
949 struct setregid_args {
950 	gid_t	rgid;
951 	gid_t	egid;
952 };
953 #endif
954 /* ARGSUSED */
955 int
956 sys_setregid(struct thread *td, struct setregid_args *uap)
957 {
958 	struct proc *p = td->td_proc;
959 	struct ucred *newcred, *oldcred;
960 	gid_t egid, rgid;
961 	int error;
962 
963 	egid = uap->egid;
964 	rgid = uap->rgid;
965 	AUDIT_ARG_EGID(egid);
966 	AUDIT_ARG_RGID(rgid);
967 	newcred = crget();
968 	PROC_LOCK(p);
969 	oldcred = crcopysafe(p, newcred);
970 
971 #ifdef MAC
972 	error = mac_cred_check_setregid(oldcred, rgid, egid);
973 	if (error)
974 		goto fail;
975 #endif
976 
977 	if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid &&
978 	    rgid != oldcred->cr_svgid) ||
979 	     (egid != (gid_t)-1 && egid != oldcred->cr_groups[0] &&
980 	     egid != oldcred->cr_rgid && egid != oldcred->cr_svgid)) &&
981 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETREGID)) != 0)
982 		goto fail;
983 
984 	if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) {
985 		change_egid(newcred, egid);
986 		setsugid(p);
987 	}
988 	if (rgid != (gid_t)-1 && oldcred->cr_rgid != rgid) {
989 		change_rgid(newcred, rgid);
990 		setsugid(p);
991 	}
992 	if ((rgid != (gid_t)-1 || newcred->cr_groups[0] != newcred->cr_rgid) &&
993 	    newcred->cr_svgid != newcred->cr_groups[0]) {
994 		change_svgid(newcred, newcred->cr_groups[0]);
995 		setsugid(p);
996 	}
997 	proc_set_cred(p, newcred);
998 	PROC_UNLOCK(p);
999 	crfree(oldcred);
1000 	return (0);
1001 
1002 fail:
1003 	PROC_UNLOCK(p);
1004 	crfree(newcred);
1005 	return (error);
1006 }
1007 
1008 /*
1009  * setresuid(ruid, euid, suid) is like setreuid except control over the saved
1010  * uid is explicit.
1011  */
1012 #ifndef _SYS_SYSPROTO_H_
1013 struct setresuid_args {
1014 	uid_t	ruid;
1015 	uid_t	euid;
1016 	uid_t	suid;
1017 };
1018 #endif
1019 /* ARGSUSED */
1020 int
1021 sys_setresuid(struct thread *td, struct setresuid_args *uap)
1022 {
1023 	struct proc *p = td->td_proc;
1024 	struct ucred *newcred, *oldcred;
1025 	uid_t euid, ruid, suid;
1026 	struct uidinfo *euip, *ruip;
1027 	int error;
1028 
1029 	euid = uap->euid;
1030 	ruid = uap->ruid;
1031 	suid = uap->suid;
1032 	AUDIT_ARG_EUID(euid);
1033 	AUDIT_ARG_RUID(ruid);
1034 	AUDIT_ARG_SUID(suid);
1035 	newcred = crget();
1036 	euip = uifind(euid);
1037 	ruip = uifind(ruid);
1038 	PROC_LOCK(p);
1039 	oldcred = crcopysafe(p, newcred);
1040 
1041 #ifdef MAC
1042 	error = mac_cred_check_setresuid(oldcred, ruid, euid, suid);
1043 	if (error)
1044 		goto fail;
1045 #endif
1046 
1047 	if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid &&
1048 	     ruid != oldcred->cr_svuid &&
1049 	      ruid != oldcred->cr_uid) ||
1050 	     (euid != (uid_t)-1 && euid != oldcred->cr_ruid &&
1051 	    euid != oldcred->cr_svuid &&
1052 	      euid != oldcred->cr_uid) ||
1053 	     (suid != (uid_t)-1 && suid != oldcred->cr_ruid &&
1054 	    suid != oldcred->cr_svuid &&
1055 	      suid != oldcred->cr_uid)) &&
1056 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETRESUID)) != 0)
1057 		goto fail;
1058 
1059 	if (euid != (uid_t)-1 && oldcred->cr_uid != euid) {
1060 		change_euid(newcred, euip);
1061 		setsugid(p);
1062 	}
1063 	if (ruid != (uid_t)-1 && oldcred->cr_ruid != ruid) {
1064 		change_ruid(newcred, ruip);
1065 		setsugid(p);
1066 	}
1067 	if (suid != (uid_t)-1 && oldcred->cr_svuid != suid) {
1068 		change_svuid(newcred, suid);
1069 		setsugid(p);
1070 	}
1071 	proc_set_cred(p, newcred);
1072 #ifdef RACCT
1073 	racct_proc_ucred_changed(p, oldcred, newcred);
1074 	crhold(newcred);
1075 #endif
1076 	PROC_UNLOCK(p);
1077 #ifdef RCTL
1078 	rctl_proc_ucred_changed(p, newcred);
1079 	crfree(newcred);
1080 #endif
1081 	uifree(ruip);
1082 	uifree(euip);
1083 	crfree(oldcred);
1084 	return (0);
1085 
1086 fail:
1087 	PROC_UNLOCK(p);
1088 	uifree(ruip);
1089 	uifree(euip);
1090 	crfree(newcred);
1091 	return (error);
1092 
1093 }
1094 
1095 /*
1096  * setresgid(rgid, egid, sgid) is like setregid except control over the saved
1097  * gid is explicit.
1098  */
1099 #ifndef _SYS_SYSPROTO_H_
1100 struct setresgid_args {
1101 	gid_t	rgid;
1102 	gid_t	egid;
1103 	gid_t	sgid;
1104 };
1105 #endif
1106 /* ARGSUSED */
1107 int
1108 sys_setresgid(struct thread *td, struct setresgid_args *uap)
1109 {
1110 	struct proc *p = td->td_proc;
1111 	struct ucred *newcred, *oldcred;
1112 	gid_t egid, rgid, sgid;
1113 	int error;
1114 
1115 	egid = uap->egid;
1116 	rgid = uap->rgid;
1117 	sgid = uap->sgid;
1118 	AUDIT_ARG_EGID(egid);
1119 	AUDIT_ARG_RGID(rgid);
1120 	AUDIT_ARG_SGID(sgid);
1121 	newcred = crget();
1122 	PROC_LOCK(p);
1123 	oldcred = crcopysafe(p, newcred);
1124 
1125 #ifdef MAC
1126 	error = mac_cred_check_setresgid(oldcred, rgid, egid, sgid);
1127 	if (error)
1128 		goto fail;
1129 #endif
1130 
1131 	if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid &&
1132 	      rgid != oldcred->cr_svgid &&
1133 	      rgid != oldcred->cr_groups[0]) ||
1134 	     (egid != (gid_t)-1 && egid != oldcred->cr_rgid &&
1135 	      egid != oldcred->cr_svgid &&
1136 	      egid != oldcred->cr_groups[0]) ||
1137 	     (sgid != (gid_t)-1 && sgid != oldcred->cr_rgid &&
1138 	      sgid != oldcred->cr_svgid &&
1139 	      sgid != oldcred->cr_groups[0])) &&
1140 	    (error = priv_check_cred(oldcred, PRIV_CRED_SETRESGID)) != 0)
1141 		goto fail;
1142 
1143 	if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) {
1144 		change_egid(newcred, egid);
1145 		setsugid(p);
1146 	}
1147 	if (rgid != (gid_t)-1 && oldcred->cr_rgid != rgid) {
1148 		change_rgid(newcred, rgid);
1149 		setsugid(p);
1150 	}
1151 	if (sgid != (gid_t)-1 && oldcred->cr_svgid != sgid) {
1152 		change_svgid(newcred, sgid);
1153 		setsugid(p);
1154 	}
1155 	proc_set_cred(p, newcred);
1156 	PROC_UNLOCK(p);
1157 	crfree(oldcred);
1158 	return (0);
1159 
1160 fail:
1161 	PROC_UNLOCK(p);
1162 	crfree(newcred);
1163 	return (error);
1164 }
1165 
1166 #ifndef _SYS_SYSPROTO_H_
1167 struct getresuid_args {
1168 	uid_t	*ruid;
1169 	uid_t	*euid;
1170 	uid_t	*suid;
1171 };
1172 #endif
1173 /* ARGSUSED */
1174 int
1175 sys_getresuid(struct thread *td, struct getresuid_args *uap)
1176 {
1177 	struct ucred *cred;
1178 	int error1 = 0, error2 = 0, error3 = 0;
1179 
1180 	cred = td->td_ucred;
1181 	if (uap->ruid)
1182 		error1 = copyout(&cred->cr_ruid,
1183 		    uap->ruid, sizeof(cred->cr_ruid));
1184 	if (uap->euid)
1185 		error2 = copyout(&cred->cr_uid,
1186 		    uap->euid, sizeof(cred->cr_uid));
1187 	if (uap->suid)
1188 		error3 = copyout(&cred->cr_svuid,
1189 		    uap->suid, sizeof(cred->cr_svuid));
1190 	return (error1 ? error1 : error2 ? error2 : error3);
1191 }
1192 
1193 #ifndef _SYS_SYSPROTO_H_
1194 struct getresgid_args {
1195 	gid_t	*rgid;
1196 	gid_t	*egid;
1197 	gid_t	*sgid;
1198 };
1199 #endif
1200 /* ARGSUSED */
1201 int
1202 sys_getresgid(struct thread *td, struct getresgid_args *uap)
1203 {
1204 	struct ucred *cred;
1205 	int error1 = 0, error2 = 0, error3 = 0;
1206 
1207 	cred = td->td_ucred;
1208 	if (uap->rgid)
1209 		error1 = copyout(&cred->cr_rgid,
1210 		    uap->rgid, sizeof(cred->cr_rgid));
1211 	if (uap->egid)
1212 		error2 = copyout(&cred->cr_groups[0],
1213 		    uap->egid, sizeof(cred->cr_groups[0]));
1214 	if (uap->sgid)
1215 		error3 = copyout(&cred->cr_svgid,
1216 		    uap->sgid, sizeof(cred->cr_svgid));
1217 	return (error1 ? error1 : error2 ? error2 : error3);
1218 }
1219 
1220 #ifndef _SYS_SYSPROTO_H_
1221 struct issetugid_args {
1222 	int dummy;
1223 };
1224 #endif
1225 /* ARGSUSED */
1226 int
1227 sys_issetugid(struct thread *td, struct issetugid_args *uap)
1228 {
1229 	struct proc *p = td->td_proc;
1230 
1231 	/*
1232 	 * Note: OpenBSD sets a P_SUGIDEXEC flag set at execve() time,
1233 	 * we use P_SUGID because we consider changing the owners as
1234 	 * "tainting" as well.
1235 	 * This is significant for procs that start as root and "become"
1236 	 * a user without an exec - programs cannot know *everything*
1237 	 * that libc *might* have put in their data segment.
1238 	 */
1239 	td->td_retval[0] = (p->p_flag & P_SUGID) ? 1 : 0;
1240 	return (0);
1241 }
1242 
1243 int
1244 sys___setugid(struct thread *td, struct __setugid_args *uap)
1245 {
1246 #ifdef REGRESSION
1247 	struct proc *p;
1248 
1249 	p = td->td_proc;
1250 	switch (uap->flag) {
1251 	case 0:
1252 		PROC_LOCK(p);
1253 		p->p_flag &= ~P_SUGID;
1254 		PROC_UNLOCK(p);
1255 		return (0);
1256 	case 1:
1257 		PROC_LOCK(p);
1258 		p->p_flag |= P_SUGID;
1259 		PROC_UNLOCK(p);
1260 		return (0);
1261 	default:
1262 		return (EINVAL);
1263 	}
1264 #else /* !REGRESSION */
1265 
1266 	return (ENOSYS);
1267 #endif /* REGRESSION */
1268 }
1269 
1270 /*
1271  * Check if gid is a member of the group set.
1272  */
1273 int
1274 groupmember(gid_t gid, struct ucred *cred)
1275 {
1276 	int l;
1277 	int h;
1278 	int m;
1279 
1280 	if (cred->cr_groups[0] == gid)
1281 		return(1);
1282 
1283 	/*
1284 	 * If gid was not our primary group, perform a binary search
1285 	 * of the supplemental groups.  This is possible because we
1286 	 * sort the groups in crsetgroups().
1287 	 */
1288 	l = 1;
1289 	h = cred->cr_ngroups;
1290 	while (l < h) {
1291 		m = l + ((h - l) / 2);
1292 		if (cred->cr_groups[m] < gid)
1293 			l = m + 1;
1294 		else
1295 			h = m;
1296 	}
1297 	if ((l < cred->cr_ngroups) && (cred->cr_groups[l] == gid))
1298 		return (1);
1299 
1300 	return (0);
1301 }
1302 
1303 /*
1304  * Test the active securelevel against a given level.  securelevel_gt()
1305  * implements (securelevel > level).  securelevel_ge() implements
1306  * (securelevel >= level).  Note that the logic is inverted -- these
1307  * functions return EPERM on "success" and 0 on "failure".
1308  *
1309  * Due to care taken when setting the securelevel, we know that no jail will
1310  * be less secure that its parent (or the physical system), so it is sufficient
1311  * to test the current jail only.
1312  *
1313  * XXXRW: Possibly since this has to do with privilege, it should move to
1314  * kern_priv.c.
1315  */
1316 int
1317 securelevel_gt(struct ucred *cr, int level)
1318 {
1319 
1320 	return (cr->cr_prison->pr_securelevel > level ? EPERM : 0);
1321 }
1322 
1323 int
1324 securelevel_ge(struct ucred *cr, int level)
1325 {
1326 
1327 	return (cr->cr_prison->pr_securelevel >= level ? EPERM : 0);
1328 }
1329 
1330 /*
1331  * 'see_other_uids' determines whether or not visibility of processes
1332  * and sockets with credentials holding different real uids is possible
1333  * using a variety of system MIBs.
1334  * XXX: data declarations should be together near the beginning of the file.
1335  */
1336 static int	see_other_uids = 1;
1337 SYSCTL_INT(_security_bsd, OID_AUTO, see_other_uids, CTLFLAG_RW,
1338     &see_other_uids, 0,
1339     "Unprivileged processes may see subjects/objects with different real uid");
1340 
1341 /*-
1342  * Determine if u1 "can see" the subject specified by u2, according to the
1343  * 'see_other_uids' policy.
1344  * Returns: 0 for permitted, ESRCH otherwise
1345  * Locks: none
1346  * References: *u1 and *u2 must not change during the call
1347  *             u1 may equal u2, in which case only one reference is required
1348  */
1349 int
1350 cr_canseeotheruids(struct ucred *u1, struct ucred *u2)
1351 {
1352 
1353 	if (!see_other_uids && u1->cr_ruid != u2->cr_ruid) {
1354 		if (priv_check_cred(u1, PRIV_SEEOTHERUIDS) != 0)
1355 			return (ESRCH);
1356 	}
1357 	return (0);
1358 }
1359 
1360 /*
1361  * 'see_other_gids' determines whether or not visibility of processes
1362  * and sockets with credentials holding different real gids is possible
1363  * using a variety of system MIBs.
1364  * XXX: data declarations should be together near the beginning of the file.
1365  */
1366 static int	see_other_gids = 1;
1367 SYSCTL_INT(_security_bsd, OID_AUTO, see_other_gids, CTLFLAG_RW,
1368     &see_other_gids, 0,
1369     "Unprivileged processes may see subjects/objects with different real gid");
1370 
1371 /*
1372  * Determine if u1 can "see" the subject specified by u2, according to the
1373  * 'see_other_gids' policy.
1374  * Returns: 0 for permitted, ESRCH otherwise
1375  * Locks: none
1376  * References: *u1 and *u2 must not change during the call
1377  *             u1 may equal u2, in which case only one reference is required
1378  */
1379 int
1380 cr_canseeothergids(struct ucred *u1, struct ucred *u2)
1381 {
1382 	int i, match;
1383 
1384 	if (!see_other_gids) {
1385 		match = 0;
1386 		for (i = 0; i < u1->cr_ngroups; i++) {
1387 			if (groupmember(u1->cr_groups[i], u2))
1388 				match = 1;
1389 			if (match)
1390 				break;
1391 		}
1392 		if (!match) {
1393 			if (priv_check_cred(u1, PRIV_SEEOTHERGIDS) != 0)
1394 				return (ESRCH);
1395 		}
1396 	}
1397 	return (0);
1398 }
1399 
1400 /*
1401  * 'see_jail_proc' determines whether or not visibility of processes and
1402  * sockets with credentials holding different jail ids is possible using a
1403  * variety of system MIBs.
1404  *
1405  * XXX: data declarations should be together near the beginning of the file.
1406  */
1407 
1408 static int	see_jail_proc = 1;
1409 SYSCTL_INT(_security_bsd, OID_AUTO, see_jail_proc, CTLFLAG_RW,
1410     &see_jail_proc, 0,
1411     "Unprivileged processes may see subjects/objects with different jail ids");
1412 
1413 /*-
1414  * Determine if u1 "can see" the subject specified by u2, according to the
1415  * 'see_jail_proc' policy.
1416  * Returns: 0 for permitted, ESRCH otherwise
1417  * Locks: none
1418  * References: *u1 and *u2 must not change during the call
1419  *             u1 may equal u2, in which case only one reference is required
1420  */
1421 int
1422 cr_canseejailproc(struct ucred *u1, struct ucred *u2)
1423 {
1424 	if (u1->cr_uid == 0)
1425 		return (0);
1426 	return (!see_jail_proc && u1->cr_prison != u2->cr_prison ? ESRCH : 0);
1427 }
1428 
1429 /*-
1430  * Determine if u1 "can see" the subject specified by u2.
1431  * Returns: 0 for permitted, an errno value otherwise
1432  * Locks: none
1433  * References: *u1 and *u2 must not change during the call
1434  *             u1 may equal u2, in which case only one reference is required
1435  */
1436 int
1437 cr_cansee(struct ucred *u1, struct ucred *u2)
1438 {
1439 	int error;
1440 
1441 	if ((error = prison_check(u1, u2)))
1442 		return (error);
1443 #ifdef MAC
1444 	if ((error = mac_cred_check_visible(u1, u2)))
1445 		return (error);
1446 #endif
1447 	if ((error = cr_canseeotheruids(u1, u2)))
1448 		return (error);
1449 	if ((error = cr_canseeothergids(u1, u2)))
1450 		return (error);
1451 	if ((error = cr_canseejailproc(u1, u2)))
1452 		return (error);
1453 	return (0);
1454 }
1455 
1456 /*-
1457  * Determine if td "can see" the subject specified by p.
1458  * Returns: 0 for permitted, an errno value otherwise
1459  * Locks: Sufficient locks to protect p->p_ucred must be held.  td really
1460  *        should be curthread.
1461  * References: td and p must be valid for the lifetime of the call
1462  */
1463 int
1464 p_cansee(struct thread *td, struct proc *p)
1465 {
1466 	/* Wrap cr_cansee() for all functionality. */
1467 	KASSERT(td == curthread, ("%s: td not curthread", __func__));
1468 	PROC_LOCK_ASSERT(p, MA_OWNED);
1469 
1470 	if (td->td_proc == p)
1471 		return (0);
1472 	return (cr_cansee(td->td_ucred, p->p_ucred));
1473 }
1474 
1475 /*
1476  * 'conservative_signals' prevents the delivery of a broad class of
1477  * signals by unprivileged processes to processes that have changed their
1478  * credentials since the last invocation of execve().  This can prevent
1479  * the leakage of cached information or retained privileges as a result
1480  * of a common class of signal-related vulnerabilities.  However, this
1481  * may interfere with some applications that expect to be able to
1482  * deliver these signals to peer processes after having given up
1483  * privilege.
1484  */
1485 static int	conservative_signals = 1;
1486 SYSCTL_INT(_security_bsd, OID_AUTO, conservative_signals, CTLFLAG_RW,
1487     &conservative_signals, 0, "Unprivileged processes prevented from "
1488     "sending certain signals to processes whose credentials have changed");
1489 /*-
1490  * Determine whether cred may deliver the specified signal to proc.
1491  * Returns: 0 for permitted, an errno value otherwise.
1492  * Locks: A lock must be held for proc.
1493  * References: cred and proc must be valid for the lifetime of the call.
1494  */
1495 int
1496 cr_cansignal(struct ucred *cred, struct proc *proc, int signum)
1497 {
1498 	int error;
1499 
1500 	PROC_LOCK_ASSERT(proc, MA_OWNED);
1501 	/*
1502 	 * Jail semantics limit the scope of signalling to proc in the
1503 	 * same jail as cred, if cred is in jail.
1504 	 */
1505 	error = prison_check(cred, proc->p_ucred);
1506 	if (error)
1507 		return (error);
1508 #ifdef MAC
1509 	if ((error = mac_proc_check_signal(cred, proc, signum)))
1510 		return (error);
1511 #endif
1512 	if ((error = cr_canseeotheruids(cred, proc->p_ucred)))
1513 		return (error);
1514 	if ((error = cr_canseeothergids(cred, proc->p_ucred)))
1515 		return (error);
1516 
1517 	/*
1518 	 * UNIX signal semantics depend on the status of the P_SUGID
1519 	 * bit on the target process.  If the bit is set, then additional
1520 	 * restrictions are placed on the set of available signals.
1521 	 */
1522 	if (conservative_signals && (proc->p_flag & P_SUGID)) {
1523 		switch (signum) {
1524 		case 0:
1525 		case SIGKILL:
1526 		case SIGINT:
1527 		case SIGTERM:
1528 		case SIGALRM:
1529 		case SIGSTOP:
1530 		case SIGTTIN:
1531 		case SIGTTOU:
1532 		case SIGTSTP:
1533 		case SIGHUP:
1534 		case SIGUSR1:
1535 		case SIGUSR2:
1536 			/*
1537 			 * Generally, permit job and terminal control
1538 			 * signals.
1539 			 */
1540 			break;
1541 		default:
1542 			/* Not permitted without privilege. */
1543 			error = priv_check_cred(cred, PRIV_SIGNAL_SUGID);
1544 			if (error)
1545 				return (error);
1546 		}
1547 	}
1548 
1549 	/*
1550 	 * Generally, the target credential's ruid or svuid must match the
1551 	 * subject credential's ruid or euid.
1552 	 */
1553 	if (cred->cr_ruid != proc->p_ucred->cr_ruid &&
1554 	    cred->cr_ruid != proc->p_ucred->cr_svuid &&
1555 	    cred->cr_uid != proc->p_ucred->cr_ruid &&
1556 	    cred->cr_uid != proc->p_ucred->cr_svuid) {
1557 		error = priv_check_cred(cred, PRIV_SIGNAL_DIFFCRED);
1558 		if (error)
1559 			return (error);
1560 	}
1561 
1562 	return (0);
1563 }
1564 
1565 /*-
1566  * Determine whether td may deliver the specified signal to p.
1567  * Returns: 0 for permitted, an errno value otherwise
1568  * Locks: Sufficient locks to protect various components of td and p
1569  *        must be held.  td must be curthread, and a lock must be
1570  *        held for p.
1571  * References: td and p must be valid for the lifetime of the call
1572  */
1573 int
1574 p_cansignal(struct thread *td, struct proc *p, int signum)
1575 {
1576 
1577 	KASSERT(td == curthread, ("%s: td not curthread", __func__));
1578 	PROC_LOCK_ASSERT(p, MA_OWNED);
1579 	if (td->td_proc == p)
1580 		return (0);
1581 
1582 	/*
1583 	 * UNIX signalling semantics require that processes in the same
1584 	 * session always be able to deliver SIGCONT to one another,
1585 	 * overriding the remaining protections.
1586 	 */
1587 	/* XXX: This will require an additional lock of some sort. */
1588 	if (signum == SIGCONT && td->td_proc->p_session == p->p_session)
1589 		return (0);
1590 	/*
1591 	 * Some compat layers use SIGTHR and higher signals for
1592 	 * communication between different kernel threads of the same
1593 	 * process, so that they expect that it's always possible to
1594 	 * deliver them, even for suid applications where cr_cansignal() can
1595 	 * deny such ability for security consideration.  It should be
1596 	 * pretty safe to do since the only way to create two processes
1597 	 * with the same p_leader is via rfork(2).
1598 	 */
1599 	if (td->td_proc->p_leader != NULL && signum >= SIGTHR &&
1600 	    signum < SIGTHR + 4 && td->td_proc->p_leader == p->p_leader)
1601 		return (0);
1602 
1603 	return (cr_cansignal(td->td_ucred, p, signum));
1604 }
1605 
1606 /*-
1607  * Determine whether td may reschedule p.
1608  * Returns: 0 for permitted, an errno value otherwise
1609  * Locks: Sufficient locks to protect various components of td and p
1610  *        must be held.  td must be curthread, and a lock must
1611  *        be held for p.
1612  * References: td and p must be valid for the lifetime of the call
1613  */
1614 int
1615 p_cansched(struct thread *td, struct proc *p)
1616 {
1617 	int error;
1618 
1619 	KASSERT(td == curthread, ("%s: td not curthread", __func__));
1620 	PROC_LOCK_ASSERT(p, MA_OWNED);
1621 	if (td->td_proc == p)
1622 		return (0);
1623 	if ((error = prison_check(td->td_ucred, p->p_ucred)))
1624 		return (error);
1625 #ifdef MAC
1626 	if ((error = mac_proc_check_sched(td->td_ucred, p)))
1627 		return (error);
1628 #endif
1629 	if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred)))
1630 		return (error);
1631 	if ((error = cr_canseeothergids(td->td_ucred, p->p_ucred)))
1632 		return (error);
1633 	if (td->td_ucred->cr_ruid != p->p_ucred->cr_ruid &&
1634 	    td->td_ucred->cr_uid != p->p_ucred->cr_ruid) {
1635 		error = priv_check(td, PRIV_SCHED_DIFFCRED);
1636 		if (error)
1637 			return (error);
1638 	}
1639 	return (0);
1640 }
1641 
1642 /*
1643  * Handle getting or setting the prison's unprivileged_proc_debug
1644  * value.
1645  */
1646 static int
1647 sysctl_unprivileged_proc_debug(SYSCTL_HANDLER_ARGS)
1648 {
1649 	int error, val;
1650 
1651 	val = prison_allow(req->td->td_ucred, PR_ALLOW_UNPRIV_DEBUG);
1652 	error = sysctl_handle_int(oidp, &val, 0, req);
1653 	if (error != 0 || req->newptr == NULL)
1654 		return (error);
1655 	if (val != 0 && val != 1)
1656 		return (EINVAL);
1657 	prison_set_allow(req->td->td_ucred, PR_ALLOW_UNPRIV_DEBUG, val);
1658 	return (0);
1659 }
1660 
1661 /*
1662  * The 'unprivileged_proc_debug' flag may be used to disable a variety of
1663  * unprivileged inter-process debugging services, including some procfs
1664  * functionality, ptrace(), and ktrace().  In the past, inter-process
1665  * debugging has been involved in a variety of security problems, and sites
1666  * not requiring the service might choose to disable it when hardening
1667  * systems.
1668  */
1669 SYSCTL_PROC(_security_bsd, OID_AUTO, unprivileged_proc_debug,
1670     CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_PRISON | CTLFLAG_SECURE |
1671     CTLFLAG_MPSAFE, 0, 0, sysctl_unprivileged_proc_debug, "I",
1672     "Unprivileged processes may use process debugging facilities");
1673 
1674 /*-
1675  * Determine whether td may debug p.
1676  * Returns: 0 for permitted, an errno value otherwise
1677  * Locks: Sufficient locks to protect various components of td and p
1678  *        must be held.  td must be curthread, and a lock must
1679  *        be held for p.
1680  * References: td and p must be valid for the lifetime of the call
1681  */
1682 int
1683 p_candebug(struct thread *td, struct proc *p)
1684 {
1685 	int error, grpsubset, i, uidsubset;
1686 
1687 	KASSERT(td == curthread, ("%s: td not curthread", __func__));
1688 	PROC_LOCK_ASSERT(p, MA_OWNED);
1689 	if (td->td_proc == p)
1690 		return (0);
1691 	if ((error = priv_check(td, PRIV_DEBUG_UNPRIV)))
1692 		return (error);
1693 	if ((error = prison_check(td->td_ucred, p->p_ucred)))
1694 		return (error);
1695 #ifdef MAC
1696 	if ((error = mac_proc_check_debug(td->td_ucred, p)))
1697 		return (error);
1698 #endif
1699 	if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred)))
1700 		return (error);
1701 	if ((error = cr_canseeothergids(td->td_ucred, p->p_ucred)))
1702 		return (error);
1703 
1704 	/*
1705 	 * Is p's group set a subset of td's effective group set?  This
1706 	 * includes p's egid, group access list, rgid, and svgid.
1707 	 */
1708 	grpsubset = 1;
1709 	for (i = 0; i < p->p_ucred->cr_ngroups; i++) {
1710 		if (!groupmember(p->p_ucred->cr_groups[i], td->td_ucred)) {
1711 			grpsubset = 0;
1712 			break;
1713 		}
1714 	}
1715 	grpsubset = grpsubset &&
1716 	    groupmember(p->p_ucred->cr_rgid, td->td_ucred) &&
1717 	    groupmember(p->p_ucred->cr_svgid, td->td_ucred);
1718 
1719 	/*
1720 	 * Are the uids present in p's credential equal to td's
1721 	 * effective uid?  This includes p's euid, svuid, and ruid.
1722 	 */
1723 	uidsubset = (td->td_ucred->cr_uid == p->p_ucred->cr_uid &&
1724 	    td->td_ucred->cr_uid == p->p_ucred->cr_svuid &&
1725 	    td->td_ucred->cr_uid == p->p_ucred->cr_ruid);
1726 
1727 	/*
1728 	 * If p's gids aren't a subset, or the uids aren't a subset,
1729 	 * or the credential has changed, require appropriate privilege
1730 	 * for td to debug p.
1731 	 */
1732 	if (!grpsubset || !uidsubset) {
1733 		error = priv_check(td, PRIV_DEBUG_DIFFCRED);
1734 		if (error)
1735 			return (error);
1736 	}
1737 
1738 	/*
1739 	 * Has the credential of the process changed since the last exec()?
1740 	 */
1741 	if ((p->p_flag & P_SUGID) != 0) {
1742 		error = priv_check(td, PRIV_DEBUG_SUGID);
1743 		if (error)
1744 			return (error);
1745 	}
1746 
1747 	/* Can't trace init when securelevel > 0. */
1748 	if (p == initproc) {
1749 		error = securelevel_gt(td->td_ucred, 0);
1750 		if (error)
1751 			return (error);
1752 	}
1753 
1754 	/*
1755 	 * Can't trace a process that's currently exec'ing.
1756 	 *
1757 	 * XXX: Note, this is not a security policy decision, it's a
1758 	 * basic correctness/functionality decision.  Therefore, this check
1759 	 * should be moved to the caller's of p_candebug().
1760 	 */
1761 	if ((p->p_flag & P_INEXEC) != 0)
1762 		return (EBUSY);
1763 
1764 	/* Denied explicitly */
1765 	if ((p->p_flag2 & P2_NOTRACE) != 0) {
1766 		error = priv_check(td, PRIV_DEBUG_DENIED);
1767 		if (error != 0)
1768 			return (error);
1769 	}
1770 
1771 	return (0);
1772 }
1773 
1774 /*-
1775  * Determine whether the subject represented by cred can "see" a socket.
1776  * Returns: 0 for permitted, ENOENT otherwise.
1777  */
1778 int
1779 cr_canseesocket(struct ucred *cred, struct socket *so)
1780 {
1781 	int error;
1782 
1783 	error = prison_check(cred, so->so_cred);
1784 	if (error)
1785 		return (ENOENT);
1786 #ifdef MAC
1787 	error = mac_socket_check_visible(cred, so);
1788 	if (error)
1789 		return (error);
1790 #endif
1791 	if (cr_canseeotheruids(cred, so->so_cred))
1792 		return (ENOENT);
1793 	if (cr_canseeothergids(cred, so->so_cred))
1794 		return (ENOENT);
1795 
1796 	return (0);
1797 }
1798 
1799 /*-
1800  * Determine whether td can wait for the exit of p.
1801  * Returns: 0 for permitted, an errno value otherwise
1802  * Locks: Sufficient locks to protect various components of td and p
1803  *        must be held.  td must be curthread, and a lock must
1804  *        be held for p.
1805  * References: td and p must be valid for the lifetime of the call
1806 
1807  */
1808 int
1809 p_canwait(struct thread *td, struct proc *p)
1810 {
1811 	int error;
1812 
1813 	KASSERT(td == curthread, ("%s: td not curthread", __func__));
1814 	PROC_LOCK_ASSERT(p, MA_OWNED);
1815 	if ((error = prison_check(td->td_ucred, p->p_ucred)))
1816 		return (error);
1817 #ifdef MAC
1818 	if ((error = mac_proc_check_wait(td->td_ucred, p)))
1819 		return (error);
1820 #endif
1821 #if 0
1822 	/* XXXMAC: This could have odd effects on some shells. */
1823 	if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred)))
1824 		return (error);
1825 #endif
1826 
1827 	return (0);
1828 }
1829 
1830 /*
1831  * Credential management.
1832  *
1833  * struct ucred objects are rarely allocated but gain and lose references all
1834  * the time (e.g., on struct file alloc/dealloc) turning refcount updates into
1835  * a significant source of cache-line ping ponging. Common cases are worked
1836  * around by modifying thread-local counter instead if the cred to operate on
1837  * matches td_realucred.
1838  *
1839  * The counter is split into 2 parts:
1840  * - cr_users -- total count of all struct proc and struct thread objects
1841  *   which have given cred in p_ucred and td_ucred respectively
1842  * - cr_ref -- the actual ref count, only valid if cr_users == 0
1843  *
1844  * If users == 0 then cr_ref behaves similarly to refcount(9), in particular if
1845  * the count reaches 0 the object is freeable.
1846  * If users > 0 and curthread->td_realucred == cred, then updates are performed
1847  * against td_ucredref.
1848  * In other cases updates are performed against cr_ref.
1849  *
1850  * Changing td_realucred into something else decrements cr_users and transfers
1851  * accumulated updates.
1852  */
1853 struct ucred *
1854 crcowget(struct ucred *cr)
1855 {
1856 
1857 	mtx_lock(&cr->cr_mtx);
1858 	KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
1859 	    __func__, cr->cr_users, cr));
1860 	cr->cr_users++;
1861 	cr->cr_ref++;
1862 	mtx_unlock(&cr->cr_mtx);
1863 	return (cr);
1864 }
1865 
1866 static struct ucred *
1867 crunuse(struct thread *td)
1868 {
1869 	struct ucred *cr, *crold;
1870 
1871 	MPASS(td->td_realucred == td->td_ucred);
1872 	cr = td->td_realucred;
1873 	mtx_lock(&cr->cr_mtx);
1874 	cr->cr_ref += td->td_ucredref;
1875 	td->td_ucredref = 0;
1876 	KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
1877 	    __func__, cr->cr_users, cr));
1878 	cr->cr_users--;
1879 	if (cr->cr_users == 0) {
1880 		KASSERT(cr->cr_ref > 0, ("%s: ref %d not > 0 on cred %p",
1881 		    __func__, cr->cr_ref, cr));
1882 		crold = cr;
1883 	} else {
1884 		cr->cr_ref--;
1885 		crold = NULL;
1886 	}
1887 	mtx_unlock(&cr->cr_mtx);
1888 	td->td_realucred = NULL;
1889 	return (crold);
1890 }
1891 
1892 static void
1893 crunusebatch(struct ucred *cr, int users, int ref)
1894 {
1895 
1896 	KASSERT(users > 0, ("%s: passed users %d not > 0 ; cred %p",
1897 	    __func__, users, cr));
1898 	mtx_lock(&cr->cr_mtx);
1899 	KASSERT(cr->cr_users >= users, ("%s: users %d not > %d on cred %p",
1900 	    __func__, cr->cr_users, users, cr));
1901 	cr->cr_users -= users;
1902 	cr->cr_ref += ref;
1903 	cr->cr_ref -= users;
1904 	if (cr->cr_users > 0) {
1905 		mtx_unlock(&cr->cr_mtx);
1906 		return;
1907 	}
1908 	KASSERT(cr->cr_ref >= 0, ("%s: ref %d not >= 0 on cred %p",
1909 	    __func__, cr->cr_ref, cr));
1910 	if (cr->cr_ref > 0) {
1911 		mtx_unlock(&cr->cr_mtx);
1912 		return;
1913 	}
1914 	crfree_final(cr);
1915 }
1916 
1917 void
1918 crcowfree(struct thread *td)
1919 {
1920 	struct ucred *cr;
1921 
1922 	cr = crunuse(td);
1923 	if (cr != NULL)
1924 		crfree(cr);
1925 }
1926 
1927 struct ucred *
1928 crcowsync(void)
1929 {
1930 	struct thread *td;
1931 	struct proc *p;
1932 	struct ucred *crnew, *crold;
1933 
1934 	td = curthread;
1935 	p = td->td_proc;
1936 	PROC_LOCK_ASSERT(p, MA_OWNED);
1937 
1938 	MPASS(td->td_realucred == td->td_ucred);
1939 	if (td->td_realucred == p->p_ucred)
1940 		return (NULL);
1941 
1942 	crnew = crcowget(p->p_ucred);
1943 	crold = crunuse(td);
1944 	td->td_realucred = crnew;
1945 	td->td_ucred = td->td_realucred;
1946 	return (crold);
1947 }
1948 
1949 /*
1950  * Batching.
1951  */
1952 void
1953 credbatch_add(struct credbatch *crb, struct thread *td)
1954 {
1955 	struct ucred *cr;
1956 
1957 	MPASS(td->td_realucred != NULL);
1958 	MPASS(td->td_realucred == td->td_ucred);
1959 	MPASS(TD_GET_STATE(td) == TDS_INACTIVE);
1960 	cr = td->td_realucred;
1961 	KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
1962 	    __func__, cr->cr_users, cr));
1963 	if (crb->cred != cr) {
1964 		if (crb->users > 0) {
1965 			MPASS(crb->cred != NULL);
1966 			crunusebatch(crb->cred, crb->users, crb->ref);
1967 			crb->users = 0;
1968 			crb->ref = 0;
1969 		}
1970 	}
1971 	crb->cred = cr;
1972 	crb->users++;
1973 	crb->ref += td->td_ucredref;
1974 	td->td_ucredref = 0;
1975 	td->td_realucred = NULL;
1976 }
1977 
1978 void
1979 credbatch_final(struct credbatch *crb)
1980 {
1981 
1982 	MPASS(crb->cred != NULL);
1983 	MPASS(crb->users > 0);
1984 	crunusebatch(crb->cred, crb->users, crb->ref);
1985 }
1986 
1987 /*
1988  * Allocate a zeroed cred structure.
1989  */
1990 struct ucred *
1991 crget(void)
1992 {
1993 	struct ucred *cr;
1994 
1995 	cr = malloc(sizeof(*cr), M_CRED, M_WAITOK | M_ZERO);
1996 	mtx_init(&cr->cr_mtx, "cred", NULL, MTX_DEF);
1997 	cr->cr_ref = 1;
1998 #ifdef AUDIT
1999 	audit_cred_init(cr);
2000 #endif
2001 #ifdef MAC
2002 	mac_cred_init(cr);
2003 #endif
2004 	cr->cr_groups = cr->cr_smallgroups;
2005 	cr->cr_agroups =
2006 	    sizeof(cr->cr_smallgroups) / sizeof(cr->cr_smallgroups[0]);
2007 	return (cr);
2008 }
2009 
2010 /*
2011  * Claim another reference to a ucred structure.
2012  */
2013 struct ucred *
2014 crhold(struct ucred *cr)
2015 {
2016 	struct thread *td;
2017 
2018 	td = curthread;
2019 	if (__predict_true(td->td_realucred == cr)) {
2020 		KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
2021 		    __func__, cr->cr_users, cr));
2022 		td->td_ucredref++;
2023 		return (cr);
2024 	}
2025 	mtx_lock(&cr->cr_mtx);
2026 	cr->cr_ref++;
2027 	mtx_unlock(&cr->cr_mtx);
2028 	return (cr);
2029 }
2030 
2031 /*
2032  * Free a cred structure.  Throws away space when ref count gets to 0.
2033  */
2034 void
2035 crfree(struct ucred *cr)
2036 {
2037 	struct thread *td;
2038 
2039 	td = curthread;
2040 	if (__predict_true(td->td_realucred == cr)) {
2041 		KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
2042 		    __func__, cr->cr_users, cr));
2043 		td->td_ucredref--;
2044 		return;
2045 	}
2046 	mtx_lock(&cr->cr_mtx);
2047 	KASSERT(cr->cr_users >= 0, ("%s: users %d not >= 0 on cred %p",
2048 	    __func__, cr->cr_users, cr));
2049 	cr->cr_ref--;
2050 	if (cr->cr_users > 0) {
2051 		mtx_unlock(&cr->cr_mtx);
2052 		return;
2053 	}
2054 	KASSERT(cr->cr_ref >= 0, ("%s: ref %d not >= 0 on cred %p",
2055 	    __func__, cr->cr_ref, cr));
2056 	if (cr->cr_ref > 0) {
2057 		mtx_unlock(&cr->cr_mtx);
2058 		return;
2059 	}
2060 	crfree_final(cr);
2061 }
2062 
2063 static void
2064 crfree_final(struct ucred *cr)
2065 {
2066 
2067 	KASSERT(cr->cr_users == 0, ("%s: users %d not == 0 on cred %p",
2068 	    __func__, cr->cr_users, cr));
2069 	KASSERT(cr->cr_ref == 0, ("%s: ref %d not == 0 on cred %p",
2070 	    __func__, cr->cr_ref, cr));
2071 
2072 	/*
2073 	 * Some callers of crget(), such as nfs_statfs(), allocate a temporary
2074 	 * credential, but don't allocate a uidinfo structure.
2075 	 */
2076 	if (cr->cr_uidinfo != NULL)
2077 		uifree(cr->cr_uidinfo);
2078 	if (cr->cr_ruidinfo != NULL)
2079 		uifree(cr->cr_ruidinfo);
2080 	if (cr->cr_prison != NULL)
2081 		prison_free(cr->cr_prison);
2082 	if (cr->cr_loginclass != NULL)
2083 		loginclass_free(cr->cr_loginclass);
2084 #ifdef AUDIT
2085 	audit_cred_destroy(cr);
2086 #endif
2087 #ifdef MAC
2088 	mac_cred_destroy(cr);
2089 #endif
2090 	mtx_destroy(&cr->cr_mtx);
2091 	if (cr->cr_groups != cr->cr_smallgroups)
2092 		free(cr->cr_groups, M_CRED);
2093 	free(cr, M_CRED);
2094 }
2095 
2096 /*
2097  * Copy a ucred's contents from a template.  Does not block.
2098  */
2099 void
2100 crcopy(struct ucred *dest, struct ucred *src)
2101 {
2102 
2103 	KASSERT(dest->cr_ref == 1, ("crcopy of shared ucred"));
2104 	bcopy(&src->cr_startcopy, &dest->cr_startcopy,
2105 	    (unsigned)((caddr_t)&src->cr_endcopy -
2106 		(caddr_t)&src->cr_startcopy));
2107 	crsetgroups(dest, src->cr_ngroups, src->cr_groups);
2108 	uihold(dest->cr_uidinfo);
2109 	uihold(dest->cr_ruidinfo);
2110 	prison_hold(dest->cr_prison);
2111 	loginclass_hold(dest->cr_loginclass);
2112 #ifdef AUDIT
2113 	audit_cred_copy(src, dest);
2114 #endif
2115 #ifdef MAC
2116 	mac_cred_copy(src, dest);
2117 #endif
2118 }
2119 
2120 /*
2121  * Dup cred struct to a new held one.
2122  */
2123 struct ucred *
2124 crdup(struct ucred *cr)
2125 {
2126 	struct ucred *newcr;
2127 
2128 	newcr = crget();
2129 	crcopy(newcr, cr);
2130 	return (newcr);
2131 }
2132 
2133 /*
2134  * Fill in a struct xucred based on a struct ucred.
2135  */
2136 void
2137 cru2x(struct ucred *cr, struct xucred *xcr)
2138 {
2139 	int ngroups;
2140 
2141 	bzero(xcr, sizeof(*xcr));
2142 	xcr->cr_version = XUCRED_VERSION;
2143 	xcr->cr_uid = cr->cr_uid;
2144 
2145 	ngroups = MIN(cr->cr_ngroups, XU_NGROUPS);
2146 	xcr->cr_ngroups = ngroups;
2147 	bcopy(cr->cr_groups, xcr->cr_groups,
2148 	    ngroups * sizeof(*cr->cr_groups));
2149 }
2150 
2151 void
2152 cru2xt(struct thread *td, struct xucred *xcr)
2153 {
2154 
2155 	cru2x(td->td_ucred, xcr);
2156 	xcr->cr_pid = td->td_proc->p_pid;
2157 }
2158 
2159 /*
2160  * Set initial process credentials.
2161  * Callers are responsible for providing the reference for provided credentials.
2162  */
2163 void
2164 proc_set_cred_init(struct proc *p, struct ucred *newcred)
2165 {
2166 
2167 	p->p_ucred = crcowget(newcred);
2168 }
2169 
2170 /*
2171  * Change process credentials.
2172  * Callers are responsible for providing the reference for passed credentials
2173  * and for freeing old ones.
2174  *
2175  * Process has to be locked except when it does not have credentials (as it
2176  * should not be visible just yet) or when newcred is NULL (as this can be
2177  * only used when the process is about to be freed, at which point it should
2178  * not be visible anymore).
2179  */
2180 void
2181 proc_set_cred(struct proc *p, struct ucred *newcred)
2182 {
2183 	struct ucred *cr;
2184 
2185 	cr = p->p_ucred;
2186 	MPASS(cr != NULL);
2187 	PROC_LOCK_ASSERT(p, MA_OWNED);
2188 	KASSERT(newcred->cr_users == 0, ("%s: users %d not 0 on cred %p",
2189 	    __func__, newcred->cr_users, newcred));
2190 	mtx_lock(&cr->cr_mtx);
2191 	KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
2192 	    __func__, cr->cr_users, cr));
2193 	cr->cr_users--;
2194 	mtx_unlock(&cr->cr_mtx);
2195 	p->p_ucred = newcred;
2196 	newcred->cr_users = 1;
2197 	PROC_UPDATE_COW(p);
2198 }
2199 
2200 void
2201 proc_unset_cred(struct proc *p)
2202 {
2203 	struct ucred *cr;
2204 
2205 	MPASS(p->p_state == PRS_ZOMBIE || p->p_state == PRS_NEW);
2206 	cr = p->p_ucred;
2207 	p->p_ucred = NULL;
2208 	KASSERT(cr->cr_users > 0, ("%s: users %d not > 0 on cred %p",
2209 	    __func__, cr->cr_users, cr));
2210 	mtx_lock(&cr->cr_mtx);
2211 	cr->cr_users--;
2212 	if (cr->cr_users == 0)
2213 		KASSERT(cr->cr_ref > 0, ("%s: ref %d not > 0 on cred %p",
2214 		    __func__, cr->cr_ref, cr));
2215 	mtx_unlock(&cr->cr_mtx);
2216 	crfree(cr);
2217 }
2218 
2219 struct ucred *
2220 crcopysafe(struct proc *p, struct ucred *cr)
2221 {
2222 	struct ucred *oldcred;
2223 	int groups;
2224 
2225 	PROC_LOCK_ASSERT(p, MA_OWNED);
2226 
2227 	oldcred = p->p_ucred;
2228 	while (cr->cr_agroups < oldcred->cr_agroups) {
2229 		groups = oldcred->cr_agroups;
2230 		PROC_UNLOCK(p);
2231 		crextend(cr, groups);
2232 		PROC_LOCK(p);
2233 		oldcred = p->p_ucred;
2234 	}
2235 	crcopy(cr, oldcred);
2236 
2237 	return (oldcred);
2238 }
2239 
2240 /*
2241  * Extend the passed in credential to hold n items.
2242  */
2243 void
2244 crextend(struct ucred *cr, int n)
2245 {
2246 	int cnt;
2247 
2248 	/* Truncate? */
2249 	if (n <= cr->cr_agroups)
2250 		return;
2251 
2252 	/*
2253 	 * We extend by 2 each time since we're using a power of two
2254 	 * allocator until we need enough groups to fill a page.
2255 	 * Once we're allocating multiple pages, only allocate as many
2256 	 * as we actually need.  The case of processes needing a
2257 	 * non-power of two number of pages seems more likely than
2258 	 * a real world process that adds thousands of groups one at a
2259 	 * time.
2260 	 */
2261 	if ( n < PAGE_SIZE / sizeof(gid_t) ) {
2262 		if (cr->cr_agroups == 0)
2263 			cnt = MAX(1, MINALLOCSIZE / sizeof(gid_t));
2264 		else
2265 			cnt = cr->cr_agroups * 2;
2266 
2267 		while (cnt < n)
2268 			cnt *= 2;
2269 	} else
2270 		cnt = roundup2(n, PAGE_SIZE / sizeof(gid_t));
2271 
2272 	/* Free the old array. */
2273 	if (cr->cr_groups != cr->cr_smallgroups)
2274 		free(cr->cr_groups, M_CRED);
2275 
2276 	cr->cr_groups = malloc(cnt * sizeof(gid_t), M_CRED, M_WAITOK | M_ZERO);
2277 	cr->cr_agroups = cnt;
2278 }
2279 
2280 /*
2281  * Copy groups in to a credential, preserving any necessary invariants.
2282  * Currently this includes the sorting of all supplemental gids.
2283  * crextend() must have been called before hand to ensure sufficient
2284  * space is available.
2285  */
2286 static void
2287 crsetgroups_locked(struct ucred *cr, int ngrp, gid_t *groups)
2288 {
2289 	int i;
2290 	int j;
2291 	gid_t g;
2292 
2293 	KASSERT(cr->cr_agroups >= ngrp, ("cr_ngroups is too small"));
2294 
2295 	bcopy(groups, cr->cr_groups, ngrp * sizeof(gid_t));
2296 	cr->cr_ngroups = ngrp;
2297 
2298 	/*
2299 	 * Sort all groups except cr_groups[0] to allow groupmember to
2300 	 * perform a binary search.
2301 	 *
2302 	 * XXX: If large numbers of groups become common this should
2303 	 * be replaced with shell sort like linux uses or possibly
2304 	 * heap sort.
2305 	 */
2306 	for (i = 2; i < ngrp; i++) {
2307 		g = cr->cr_groups[i];
2308 		for (j = i-1; j >= 1 && g < cr->cr_groups[j]; j--)
2309 			cr->cr_groups[j + 1] = cr->cr_groups[j];
2310 		cr->cr_groups[j + 1] = g;
2311 	}
2312 }
2313 
2314 /*
2315  * Copy groups in to a credential after expanding it if required.
2316  * Truncate the list to (ngroups_max + 1) if it is too large.
2317  */
2318 void
2319 crsetgroups(struct ucred *cr, int ngrp, gid_t *groups)
2320 {
2321 
2322 	if (ngrp > ngroups_max + 1)
2323 		ngrp = ngroups_max + 1;
2324 
2325 	crextend(cr, ngrp);
2326 	crsetgroups_locked(cr, ngrp, groups);
2327 }
2328 
2329 /*
2330  * Get login name, if available.
2331  */
2332 #ifndef _SYS_SYSPROTO_H_
2333 struct getlogin_args {
2334 	char	*namebuf;
2335 	u_int	namelen;
2336 };
2337 #endif
2338 /* ARGSUSED */
2339 int
2340 sys_getlogin(struct thread *td, struct getlogin_args *uap)
2341 {
2342 	char login[MAXLOGNAME];
2343 	struct proc *p = td->td_proc;
2344 	size_t len;
2345 
2346 	if (uap->namelen > MAXLOGNAME)
2347 		uap->namelen = MAXLOGNAME;
2348 	PROC_LOCK(p);
2349 	SESS_LOCK(p->p_session);
2350 	len = strlcpy(login, p->p_session->s_login, uap->namelen) + 1;
2351 	SESS_UNLOCK(p->p_session);
2352 	PROC_UNLOCK(p);
2353 	if (len > uap->namelen)
2354 		return (ERANGE);
2355 	return (copyout(login, uap->namebuf, len));
2356 }
2357 
2358 /*
2359  * Set login name.
2360  */
2361 #ifndef _SYS_SYSPROTO_H_
2362 struct setlogin_args {
2363 	char	*namebuf;
2364 };
2365 #endif
2366 /* ARGSUSED */
2367 int
2368 sys_setlogin(struct thread *td, struct setlogin_args *uap)
2369 {
2370 	struct proc *p = td->td_proc;
2371 	int error;
2372 	char logintmp[MAXLOGNAME];
2373 
2374 	CTASSERT(sizeof(p->p_session->s_login) >= sizeof(logintmp));
2375 
2376 	error = priv_check(td, PRIV_PROC_SETLOGIN);
2377 	if (error)
2378 		return (error);
2379 	error = copyinstr(uap->namebuf, logintmp, sizeof(logintmp), NULL);
2380 	if (error != 0) {
2381 		if (error == ENAMETOOLONG)
2382 			error = EINVAL;
2383 		return (error);
2384 	}
2385 	AUDIT_ARG_LOGIN(logintmp);
2386 	PROC_LOCK(p);
2387 	SESS_LOCK(p->p_session);
2388 	strcpy(p->p_session->s_login, logintmp);
2389 	SESS_UNLOCK(p->p_session);
2390 	PROC_UNLOCK(p);
2391 	return (0);
2392 }
2393 
2394 void
2395 setsugid(struct proc *p)
2396 {
2397 
2398 	PROC_LOCK_ASSERT(p, MA_OWNED);
2399 	p->p_flag |= P_SUGID;
2400 }
2401 
2402 /*-
2403  * Change a process's effective uid.
2404  * Side effects: newcred->cr_uid and newcred->cr_uidinfo will be modified.
2405  * References: newcred must be an exclusive credential reference for the
2406  *             duration of the call.
2407  */
2408 void
2409 change_euid(struct ucred *newcred, struct uidinfo *euip)
2410 {
2411 
2412 	newcred->cr_uid = euip->ui_uid;
2413 	uihold(euip);
2414 	uifree(newcred->cr_uidinfo);
2415 	newcred->cr_uidinfo = euip;
2416 }
2417 
2418 /*-
2419  * Change a process's effective gid.
2420  * Side effects: newcred->cr_gid will be modified.
2421  * References: newcred must be an exclusive credential reference for the
2422  *             duration of the call.
2423  */
2424 void
2425 change_egid(struct ucred *newcred, gid_t egid)
2426 {
2427 
2428 	newcred->cr_groups[0] = egid;
2429 }
2430 
2431 /*-
2432  * Change a process's real uid.
2433  * Side effects: newcred->cr_ruid will be updated, newcred->cr_ruidinfo
2434  *               will be updated, and the old and new cr_ruidinfo proc
2435  *               counts will be updated.
2436  * References: newcred must be an exclusive credential reference for the
2437  *             duration of the call.
2438  */
2439 void
2440 change_ruid(struct ucred *newcred, struct uidinfo *ruip)
2441 {
2442 
2443 	(void)chgproccnt(newcred->cr_ruidinfo, -1, 0);
2444 	newcred->cr_ruid = ruip->ui_uid;
2445 	uihold(ruip);
2446 	uifree(newcred->cr_ruidinfo);
2447 	newcred->cr_ruidinfo = ruip;
2448 	(void)chgproccnt(newcred->cr_ruidinfo, 1, 0);
2449 }
2450 
2451 /*-
2452  * Change a process's real gid.
2453  * Side effects: newcred->cr_rgid will be updated.
2454  * References: newcred must be an exclusive credential reference for the
2455  *             duration of the call.
2456  */
2457 void
2458 change_rgid(struct ucred *newcred, gid_t rgid)
2459 {
2460 
2461 	newcred->cr_rgid = rgid;
2462 }
2463 
2464 /*-
2465  * Change a process's saved uid.
2466  * Side effects: newcred->cr_svuid will be updated.
2467  * References: newcred must be an exclusive credential reference for the
2468  *             duration of the call.
2469  */
2470 void
2471 change_svuid(struct ucred *newcred, uid_t svuid)
2472 {
2473 
2474 	newcred->cr_svuid = svuid;
2475 }
2476 
2477 /*-
2478  * Change a process's saved gid.
2479  * Side effects: newcred->cr_svgid will be updated.
2480  * References: newcred must be an exclusive credential reference for the
2481  *             duration of the call.
2482  */
2483 void
2484 change_svgid(struct ucred *newcred, gid_t svgid)
2485 {
2486 
2487 	newcred->cr_svgid = svgid;
2488 }
2489 
2490 bool allow_ptrace = true;
2491 SYSCTL_BOOL(_security_bsd, OID_AUTO, allow_ptrace, CTLFLAG_RWTUN,
2492     &allow_ptrace, 0,
2493     "Deny ptrace(2) use by returning ENOSYS");
2494