1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 1982, 1986, 1989, 1990, 1991, 1993 5 * The Regents of the University of California. 6 * (c) UNIX System Laboratories, Inc. 7 * Copyright (c) 2000-2001 Robert N. M. Watson. 8 * All rights reserved. 9 * 10 * All or some portions of this file are derived from material licensed 11 * to the University of California by American Telephone and Telegraph 12 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 13 * the permission of UNIX System Laboratories, Inc. 14 * 15 * Redistribution and use in source and binary forms, with or without 16 * modification, are permitted provided that the following conditions 17 * are met: 18 * 1. Redistributions of source code must retain the above copyright 19 * notice, this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright 21 * notice, this list of conditions and the following disclaimer in the 22 * documentation and/or other materials provided with the distribution. 23 * 3. Neither the name of the University nor the names of its contributors 24 * may be used to endorse or promote products derived from this software 25 * without specific prior written permission. 26 * 27 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 28 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 29 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 30 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 31 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 32 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 33 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 34 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 35 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 36 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 37 * SUCH DAMAGE. 38 * 39 * @(#)kern_prot.c 8.6 (Berkeley) 1/21/94 40 */ 41 42 /* 43 * System calls related to processes and protection 44 */ 45 46 #include <sys/cdefs.h> 47 __FBSDID("$FreeBSD$"); 48 49 #include "opt_inet.h" 50 #include "opt_inet6.h" 51 52 #include <sys/param.h> 53 #include <sys/systm.h> 54 #include <sys/acct.h> 55 #include <sys/kdb.h> 56 #include <sys/kernel.h> 57 #include <sys/lock.h> 58 #include <sys/loginclass.h> 59 #include <sys/malloc.h> 60 #include <sys/mutex.h> 61 #include <sys/refcount.h> 62 #include <sys/sx.h> 63 #include <sys/priv.h> 64 #include <sys/proc.h> 65 #include <sys/sysent.h> 66 #include <sys/sysproto.h> 67 #include <sys/jail.h> 68 #include <sys/racct.h> 69 #include <sys/rctl.h> 70 #include <sys/resourcevar.h> 71 #include <sys/socket.h> 72 #include <sys/socketvar.h> 73 #include <sys/syscallsubr.h> 74 #include <sys/sysctl.h> 75 76 #ifdef REGRESSION 77 FEATURE(regression, 78 "Kernel support for interfaces necessary for regression testing (SECURITY RISK!)"); 79 #endif 80 81 #include <security/audit/audit.h> 82 #include <security/mac/mac_framework.h> 83 84 static MALLOC_DEFINE(M_CRED, "cred", "credentials"); 85 86 SYSCTL_NODE(_security, OID_AUTO, bsd, CTLFLAG_RW | CTLFLAG_MPSAFE, 0, 87 "BSD security policy"); 88 89 static void crsetgroups_locked(struct ucred *cr, int ngrp, 90 gid_t *groups); 91 92 #ifndef _SYS_SYSPROTO_H_ 93 struct getpid_args { 94 int dummy; 95 }; 96 #endif 97 /* ARGSUSED */ 98 int 99 sys_getpid(struct thread *td, struct getpid_args *uap) 100 { 101 struct proc *p = td->td_proc; 102 103 td->td_retval[0] = p->p_pid; 104 #if defined(COMPAT_43) 105 if (SV_PROC_FLAG(p, SV_AOUT)) 106 td->td_retval[1] = kern_getppid(td); 107 #endif 108 return (0); 109 } 110 111 #ifndef _SYS_SYSPROTO_H_ 112 struct getppid_args { 113 int dummy; 114 }; 115 #endif 116 /* ARGSUSED */ 117 int 118 sys_getppid(struct thread *td, struct getppid_args *uap) 119 { 120 121 td->td_retval[0] = kern_getppid(td); 122 return (0); 123 } 124 125 int 126 kern_getppid(struct thread *td) 127 { 128 struct proc *p = td->td_proc; 129 130 return (p->p_oppid); 131 } 132 133 /* 134 * Get process group ID; note that POSIX getpgrp takes no parameter. 135 */ 136 #ifndef _SYS_SYSPROTO_H_ 137 struct getpgrp_args { 138 int dummy; 139 }; 140 #endif 141 int 142 sys_getpgrp(struct thread *td, struct getpgrp_args *uap) 143 { 144 struct proc *p = td->td_proc; 145 146 PROC_LOCK(p); 147 td->td_retval[0] = p->p_pgrp->pg_id; 148 PROC_UNLOCK(p); 149 return (0); 150 } 151 152 /* Get an arbitrary pid's process group id */ 153 #ifndef _SYS_SYSPROTO_H_ 154 struct getpgid_args { 155 pid_t pid; 156 }; 157 #endif 158 int 159 sys_getpgid(struct thread *td, struct getpgid_args *uap) 160 { 161 struct proc *p; 162 int error; 163 164 if (uap->pid == 0) { 165 p = td->td_proc; 166 PROC_LOCK(p); 167 } else { 168 p = pfind(uap->pid); 169 if (p == NULL) 170 return (ESRCH); 171 error = p_cansee(td, p); 172 if (error) { 173 PROC_UNLOCK(p); 174 return (error); 175 } 176 } 177 td->td_retval[0] = p->p_pgrp->pg_id; 178 PROC_UNLOCK(p); 179 return (0); 180 } 181 182 /* 183 * Get an arbitrary pid's session id. 184 */ 185 #ifndef _SYS_SYSPROTO_H_ 186 struct getsid_args { 187 pid_t pid; 188 }; 189 #endif 190 int 191 sys_getsid(struct thread *td, struct getsid_args *uap) 192 { 193 194 return (kern_getsid(td, uap->pid)); 195 } 196 197 int 198 kern_getsid(struct thread *td, pid_t pid) 199 { 200 struct proc *p; 201 int error; 202 203 if (pid == 0) { 204 p = td->td_proc; 205 PROC_LOCK(p); 206 } else { 207 p = pfind(pid); 208 if (p == NULL) 209 return (ESRCH); 210 error = p_cansee(td, p); 211 if (error) { 212 PROC_UNLOCK(p); 213 return (error); 214 } 215 } 216 td->td_retval[0] = p->p_session->s_sid; 217 PROC_UNLOCK(p); 218 return (0); 219 } 220 221 #ifndef _SYS_SYSPROTO_H_ 222 struct getuid_args { 223 int dummy; 224 }; 225 #endif 226 /* ARGSUSED */ 227 int 228 sys_getuid(struct thread *td, struct getuid_args *uap) 229 { 230 231 td->td_retval[0] = td->td_ucred->cr_ruid; 232 #if defined(COMPAT_43) 233 td->td_retval[1] = td->td_ucred->cr_uid; 234 #endif 235 return (0); 236 } 237 238 #ifndef _SYS_SYSPROTO_H_ 239 struct geteuid_args { 240 int dummy; 241 }; 242 #endif 243 /* ARGSUSED */ 244 int 245 sys_geteuid(struct thread *td, struct geteuid_args *uap) 246 { 247 248 td->td_retval[0] = td->td_ucred->cr_uid; 249 return (0); 250 } 251 252 #ifndef _SYS_SYSPROTO_H_ 253 struct getgid_args { 254 int dummy; 255 }; 256 #endif 257 /* ARGSUSED */ 258 int 259 sys_getgid(struct thread *td, struct getgid_args *uap) 260 { 261 262 td->td_retval[0] = td->td_ucred->cr_rgid; 263 #if defined(COMPAT_43) 264 td->td_retval[1] = td->td_ucred->cr_groups[0]; 265 #endif 266 return (0); 267 } 268 269 /* 270 * Get effective group ID. The "egid" is groups[0], and could be obtained 271 * via getgroups. This syscall exists because it is somewhat painful to do 272 * correctly in a library function. 273 */ 274 #ifndef _SYS_SYSPROTO_H_ 275 struct getegid_args { 276 int dummy; 277 }; 278 #endif 279 /* ARGSUSED */ 280 int 281 sys_getegid(struct thread *td, struct getegid_args *uap) 282 { 283 284 td->td_retval[0] = td->td_ucred->cr_groups[0]; 285 return (0); 286 } 287 288 #ifndef _SYS_SYSPROTO_H_ 289 struct getgroups_args { 290 u_int gidsetsize; 291 gid_t *gidset; 292 }; 293 #endif 294 int 295 sys_getgroups(struct thread *td, struct getgroups_args *uap) 296 { 297 struct ucred *cred; 298 u_int ngrp; 299 int error; 300 301 cred = td->td_ucred; 302 ngrp = cred->cr_ngroups; 303 304 if (uap->gidsetsize == 0) { 305 error = 0; 306 goto out; 307 } 308 if (uap->gidsetsize < ngrp) 309 return (EINVAL); 310 311 error = copyout(cred->cr_groups, uap->gidset, ngrp * sizeof(gid_t)); 312 out: 313 td->td_retval[0] = ngrp; 314 return (error); 315 } 316 317 #ifndef _SYS_SYSPROTO_H_ 318 struct setsid_args { 319 int dummy; 320 }; 321 #endif 322 /* ARGSUSED */ 323 int 324 sys_setsid(struct thread *td, struct setsid_args *uap) 325 { 326 struct pgrp *pgrp; 327 int error; 328 struct proc *p = td->td_proc; 329 struct pgrp *newpgrp; 330 struct session *newsess; 331 332 error = 0; 333 pgrp = NULL; 334 335 newpgrp = malloc(sizeof(struct pgrp), M_PGRP, M_WAITOK | M_ZERO); 336 newsess = malloc(sizeof(struct session), M_SESSION, M_WAITOK | M_ZERO); 337 338 sx_xlock(&proctree_lock); 339 340 if (p->p_pgid == p->p_pid || (pgrp = pgfind(p->p_pid)) != NULL) { 341 if (pgrp != NULL) 342 PGRP_UNLOCK(pgrp); 343 error = EPERM; 344 } else { 345 (void)enterpgrp(p, p->p_pid, newpgrp, newsess); 346 td->td_retval[0] = p->p_pid; 347 newpgrp = NULL; 348 newsess = NULL; 349 } 350 351 sx_xunlock(&proctree_lock); 352 353 if (newpgrp != NULL) 354 free(newpgrp, M_PGRP); 355 if (newsess != NULL) 356 free(newsess, M_SESSION); 357 358 return (error); 359 } 360 361 /* 362 * set process group (setpgid/old setpgrp) 363 * 364 * caller does setpgid(targpid, targpgid) 365 * 366 * pid must be caller or child of caller (ESRCH) 367 * if a child 368 * pid must be in same session (EPERM) 369 * pid can't have done an exec (EACCES) 370 * if pgid != pid 371 * there must exist some pid in same session having pgid (EPERM) 372 * pid must not be session leader (EPERM) 373 */ 374 #ifndef _SYS_SYSPROTO_H_ 375 struct setpgid_args { 376 int pid; /* target process id */ 377 int pgid; /* target pgrp id */ 378 }; 379 #endif 380 /* ARGSUSED */ 381 int 382 sys_setpgid(struct thread *td, struct setpgid_args *uap) 383 { 384 struct proc *curp = td->td_proc; 385 struct proc *targp; /* target process */ 386 struct pgrp *pgrp; /* target pgrp */ 387 int error; 388 struct pgrp *newpgrp; 389 390 if (uap->pgid < 0) 391 return (EINVAL); 392 393 error = 0; 394 395 newpgrp = malloc(sizeof(struct pgrp), M_PGRP, M_WAITOK | M_ZERO); 396 397 sx_xlock(&proctree_lock); 398 if (uap->pid != 0 && uap->pid != curp->p_pid) { 399 if ((targp = pfind(uap->pid)) == NULL) { 400 error = ESRCH; 401 goto done; 402 } 403 if (!inferior(targp)) { 404 PROC_UNLOCK(targp); 405 error = ESRCH; 406 goto done; 407 } 408 if ((error = p_cansee(td, targp))) { 409 PROC_UNLOCK(targp); 410 goto done; 411 } 412 if (targp->p_pgrp == NULL || 413 targp->p_session != curp->p_session) { 414 PROC_UNLOCK(targp); 415 error = EPERM; 416 goto done; 417 } 418 if (targp->p_flag & P_EXEC) { 419 PROC_UNLOCK(targp); 420 error = EACCES; 421 goto done; 422 } 423 PROC_UNLOCK(targp); 424 } else 425 targp = curp; 426 if (SESS_LEADER(targp)) { 427 error = EPERM; 428 goto done; 429 } 430 if (uap->pgid == 0) 431 uap->pgid = targp->p_pid; 432 if ((pgrp = pgfind(uap->pgid)) == NULL) { 433 if (uap->pgid == targp->p_pid) { 434 error = enterpgrp(targp, uap->pgid, newpgrp, 435 NULL); 436 if (error == 0) 437 newpgrp = NULL; 438 } else 439 error = EPERM; 440 } else { 441 if (pgrp == targp->p_pgrp) { 442 PGRP_UNLOCK(pgrp); 443 goto done; 444 } 445 if (pgrp->pg_id != targp->p_pid && 446 pgrp->pg_session != curp->p_session) { 447 PGRP_UNLOCK(pgrp); 448 error = EPERM; 449 goto done; 450 } 451 PGRP_UNLOCK(pgrp); 452 error = enterthispgrp(targp, pgrp); 453 } 454 done: 455 sx_xunlock(&proctree_lock); 456 KASSERT((error == 0) || (newpgrp != NULL), 457 ("setpgid failed and newpgrp is NULL")); 458 if (newpgrp != NULL) 459 free(newpgrp, M_PGRP); 460 return (error); 461 } 462 463 /* 464 * Use the clause in B.4.2.2 that allows setuid/setgid to be 4.2/4.3BSD 465 * compatible. It says that setting the uid/gid to euid/egid is a special 466 * case of "appropriate privilege". Once the rules are expanded out, this 467 * basically means that setuid(nnn) sets all three id's, in all permitted 468 * cases unless _POSIX_SAVED_IDS is enabled. In that case, setuid(getuid()) 469 * does not set the saved id - this is dangerous for traditional BSD 470 * programs. For this reason, we *really* do not want to set 471 * _POSIX_SAVED_IDS and do not want to clear POSIX_APPENDIX_B_4_2_2. 472 */ 473 #define POSIX_APPENDIX_B_4_2_2 474 475 #ifndef _SYS_SYSPROTO_H_ 476 struct setuid_args { 477 uid_t uid; 478 }; 479 #endif 480 /* ARGSUSED */ 481 int 482 sys_setuid(struct thread *td, struct setuid_args *uap) 483 { 484 struct proc *p = td->td_proc; 485 struct ucred *newcred, *oldcred; 486 uid_t uid; 487 struct uidinfo *uip; 488 int error; 489 490 uid = uap->uid; 491 AUDIT_ARG_UID(uid); 492 newcred = crget(); 493 uip = uifind(uid); 494 PROC_LOCK(p); 495 /* 496 * Copy credentials so other references do not see our changes. 497 */ 498 oldcred = crcopysafe(p, newcred); 499 500 #ifdef MAC 501 error = mac_cred_check_setuid(oldcred, uid); 502 if (error) 503 goto fail; 504 #endif 505 506 /* 507 * See if we have "permission" by POSIX 1003.1 rules. 508 * 509 * Note that setuid(geteuid()) is a special case of 510 * "appropriate privileges" in appendix B.4.2.2. We need 511 * to use this clause to be compatible with traditional BSD 512 * semantics. Basically, it means that "setuid(xx)" sets all 513 * three id's (assuming you have privs). 514 * 515 * Notes on the logic. We do things in three steps. 516 * 1: We determine if the euid is going to change, and do EPERM 517 * right away. We unconditionally change the euid later if this 518 * test is satisfied, simplifying that part of the logic. 519 * 2: We determine if the real and/or saved uids are going to 520 * change. Determined by compile options. 521 * 3: Change euid last. (after tests in #2 for "appropriate privs") 522 */ 523 if (uid != oldcred->cr_ruid && /* allow setuid(getuid()) */ 524 #ifdef _POSIX_SAVED_IDS 525 uid != oldcred->cr_svuid && /* allow setuid(saved gid) */ 526 #endif 527 #ifdef POSIX_APPENDIX_B_4_2_2 /* Use BSD-compat clause from B.4.2.2 */ 528 uid != oldcred->cr_uid && /* allow setuid(geteuid()) */ 529 #endif 530 (error = priv_check_cred(oldcred, PRIV_CRED_SETUID)) != 0) 531 goto fail; 532 533 #ifdef _POSIX_SAVED_IDS 534 /* 535 * Do we have "appropriate privileges" (are we root or uid == euid) 536 * If so, we are changing the real uid and/or saved uid. 537 */ 538 if ( 539 #ifdef POSIX_APPENDIX_B_4_2_2 /* Use the clause from B.4.2.2 */ 540 uid == oldcred->cr_uid || 541 #endif 542 /* We are using privs. */ 543 priv_check_cred(oldcred, PRIV_CRED_SETUID) == 0) 544 #endif 545 { 546 /* 547 * Set the real uid and transfer proc count to new user. 548 */ 549 if (uid != oldcred->cr_ruid) { 550 change_ruid(newcred, uip); 551 setsugid(p); 552 } 553 /* 554 * Set saved uid 555 * 556 * XXX always set saved uid even if not _POSIX_SAVED_IDS, as 557 * the security of seteuid() depends on it. B.4.2.2 says it 558 * is important that we should do this. 559 */ 560 if (uid != oldcred->cr_svuid) { 561 change_svuid(newcred, uid); 562 setsugid(p); 563 } 564 } 565 566 /* 567 * In all permitted cases, we are changing the euid. 568 */ 569 if (uid != oldcred->cr_uid) { 570 change_euid(newcred, uip); 571 setsugid(p); 572 } 573 proc_set_cred(p, newcred); 574 #ifdef RACCT 575 racct_proc_ucred_changed(p, oldcred, newcred); 576 crhold(newcred); 577 #endif 578 PROC_UNLOCK(p); 579 #ifdef RCTL 580 rctl_proc_ucred_changed(p, newcred); 581 crfree(newcred); 582 #endif 583 uifree(uip); 584 crfree(oldcred); 585 return (0); 586 587 fail: 588 PROC_UNLOCK(p); 589 uifree(uip); 590 crfree(newcred); 591 return (error); 592 } 593 594 #ifndef _SYS_SYSPROTO_H_ 595 struct seteuid_args { 596 uid_t euid; 597 }; 598 #endif 599 /* ARGSUSED */ 600 int 601 sys_seteuid(struct thread *td, struct seteuid_args *uap) 602 { 603 struct proc *p = td->td_proc; 604 struct ucred *newcred, *oldcred; 605 uid_t euid; 606 struct uidinfo *euip; 607 int error; 608 609 euid = uap->euid; 610 AUDIT_ARG_EUID(euid); 611 newcred = crget(); 612 euip = uifind(euid); 613 PROC_LOCK(p); 614 /* 615 * Copy credentials so other references do not see our changes. 616 */ 617 oldcred = crcopysafe(p, newcred); 618 619 #ifdef MAC 620 error = mac_cred_check_seteuid(oldcred, euid); 621 if (error) 622 goto fail; 623 #endif 624 625 if (euid != oldcred->cr_ruid && /* allow seteuid(getuid()) */ 626 euid != oldcred->cr_svuid && /* allow seteuid(saved uid) */ 627 (error = priv_check_cred(oldcred, PRIV_CRED_SETEUID)) != 0) 628 goto fail; 629 630 /* 631 * Everything's okay, do it. 632 */ 633 if (oldcred->cr_uid != euid) { 634 change_euid(newcred, euip); 635 setsugid(p); 636 } 637 proc_set_cred(p, newcred); 638 PROC_UNLOCK(p); 639 uifree(euip); 640 crfree(oldcred); 641 return (0); 642 643 fail: 644 PROC_UNLOCK(p); 645 uifree(euip); 646 crfree(newcred); 647 return (error); 648 } 649 650 #ifndef _SYS_SYSPROTO_H_ 651 struct setgid_args { 652 gid_t gid; 653 }; 654 #endif 655 /* ARGSUSED */ 656 int 657 sys_setgid(struct thread *td, struct setgid_args *uap) 658 { 659 struct proc *p = td->td_proc; 660 struct ucred *newcred, *oldcred; 661 gid_t gid; 662 int error; 663 664 gid = uap->gid; 665 AUDIT_ARG_GID(gid); 666 newcred = crget(); 667 PROC_LOCK(p); 668 oldcred = crcopysafe(p, newcred); 669 670 #ifdef MAC 671 error = mac_cred_check_setgid(oldcred, gid); 672 if (error) 673 goto fail; 674 #endif 675 676 /* 677 * See if we have "permission" by POSIX 1003.1 rules. 678 * 679 * Note that setgid(getegid()) is a special case of 680 * "appropriate privileges" in appendix B.4.2.2. We need 681 * to use this clause to be compatible with traditional BSD 682 * semantics. Basically, it means that "setgid(xx)" sets all 683 * three id's (assuming you have privs). 684 * 685 * For notes on the logic here, see setuid() above. 686 */ 687 if (gid != oldcred->cr_rgid && /* allow setgid(getgid()) */ 688 #ifdef _POSIX_SAVED_IDS 689 gid != oldcred->cr_svgid && /* allow setgid(saved gid) */ 690 #endif 691 #ifdef POSIX_APPENDIX_B_4_2_2 /* Use BSD-compat clause from B.4.2.2 */ 692 gid != oldcred->cr_groups[0] && /* allow setgid(getegid()) */ 693 #endif 694 (error = priv_check_cred(oldcred, PRIV_CRED_SETGID)) != 0) 695 goto fail; 696 697 #ifdef _POSIX_SAVED_IDS 698 /* 699 * Do we have "appropriate privileges" (are we root or gid == egid) 700 * If so, we are changing the real uid and saved gid. 701 */ 702 if ( 703 #ifdef POSIX_APPENDIX_B_4_2_2 /* use the clause from B.4.2.2 */ 704 gid == oldcred->cr_groups[0] || 705 #endif 706 /* We are using privs. */ 707 priv_check_cred(oldcred, PRIV_CRED_SETGID) == 0) 708 #endif 709 { 710 /* 711 * Set real gid 712 */ 713 if (oldcred->cr_rgid != gid) { 714 change_rgid(newcred, gid); 715 setsugid(p); 716 } 717 /* 718 * Set saved gid 719 * 720 * XXX always set saved gid even if not _POSIX_SAVED_IDS, as 721 * the security of setegid() depends on it. B.4.2.2 says it 722 * is important that we should do this. 723 */ 724 if (oldcred->cr_svgid != gid) { 725 change_svgid(newcred, gid); 726 setsugid(p); 727 } 728 } 729 /* 730 * In all cases permitted cases, we are changing the egid. 731 * Copy credentials so other references do not see our changes. 732 */ 733 if (oldcred->cr_groups[0] != gid) { 734 change_egid(newcred, gid); 735 setsugid(p); 736 } 737 proc_set_cred(p, newcred); 738 PROC_UNLOCK(p); 739 crfree(oldcred); 740 return (0); 741 742 fail: 743 PROC_UNLOCK(p); 744 crfree(newcred); 745 return (error); 746 } 747 748 #ifndef _SYS_SYSPROTO_H_ 749 struct setegid_args { 750 gid_t egid; 751 }; 752 #endif 753 /* ARGSUSED */ 754 int 755 sys_setegid(struct thread *td, struct setegid_args *uap) 756 { 757 struct proc *p = td->td_proc; 758 struct ucred *newcred, *oldcred; 759 gid_t egid; 760 int error; 761 762 egid = uap->egid; 763 AUDIT_ARG_EGID(egid); 764 newcred = crget(); 765 PROC_LOCK(p); 766 oldcred = crcopysafe(p, newcred); 767 768 #ifdef MAC 769 error = mac_cred_check_setegid(oldcred, egid); 770 if (error) 771 goto fail; 772 #endif 773 774 if (egid != oldcred->cr_rgid && /* allow setegid(getgid()) */ 775 egid != oldcred->cr_svgid && /* allow setegid(saved gid) */ 776 (error = priv_check_cred(oldcred, PRIV_CRED_SETEGID)) != 0) 777 goto fail; 778 779 if (oldcred->cr_groups[0] != egid) { 780 change_egid(newcred, egid); 781 setsugid(p); 782 } 783 proc_set_cred(p, newcred); 784 PROC_UNLOCK(p); 785 crfree(oldcred); 786 return (0); 787 788 fail: 789 PROC_UNLOCK(p); 790 crfree(newcred); 791 return (error); 792 } 793 794 #ifndef _SYS_SYSPROTO_H_ 795 struct setgroups_args { 796 u_int gidsetsize; 797 gid_t *gidset; 798 }; 799 #endif 800 /* ARGSUSED */ 801 int 802 sys_setgroups(struct thread *td, struct setgroups_args *uap) 803 { 804 gid_t smallgroups[XU_NGROUPS]; 805 gid_t *groups; 806 u_int gidsetsize; 807 int error; 808 809 gidsetsize = uap->gidsetsize; 810 if (gidsetsize > ngroups_max + 1) 811 return (EINVAL); 812 813 if (gidsetsize > XU_NGROUPS) 814 groups = malloc(gidsetsize * sizeof(gid_t), M_TEMP, M_WAITOK); 815 else 816 groups = smallgroups; 817 818 error = copyin(uap->gidset, groups, gidsetsize * sizeof(gid_t)); 819 if (error == 0) 820 error = kern_setgroups(td, gidsetsize, groups); 821 822 if (gidsetsize > XU_NGROUPS) 823 free(groups, M_TEMP); 824 return (error); 825 } 826 827 int 828 kern_setgroups(struct thread *td, u_int ngrp, gid_t *groups) 829 { 830 struct proc *p = td->td_proc; 831 struct ucred *newcred, *oldcred; 832 int error; 833 834 MPASS(ngrp <= ngroups_max + 1); 835 AUDIT_ARG_GROUPSET(groups, ngrp); 836 newcred = crget(); 837 crextend(newcred, ngrp); 838 PROC_LOCK(p); 839 oldcred = crcopysafe(p, newcred); 840 841 #ifdef MAC 842 error = mac_cred_check_setgroups(oldcred, ngrp, groups); 843 if (error) 844 goto fail; 845 #endif 846 847 error = priv_check_cred(oldcred, PRIV_CRED_SETGROUPS); 848 if (error) 849 goto fail; 850 851 if (ngrp == 0) { 852 /* 853 * setgroups(0, NULL) is a legitimate way of clearing the 854 * groups vector on non-BSD systems (which generally do not 855 * have the egid in the groups[0]). We risk security holes 856 * when running non-BSD software if we do not do the same. 857 */ 858 newcred->cr_ngroups = 1; 859 } else { 860 crsetgroups_locked(newcred, ngrp, groups); 861 } 862 setsugid(p); 863 proc_set_cred(p, newcred); 864 PROC_UNLOCK(p); 865 crfree(oldcred); 866 return (0); 867 868 fail: 869 PROC_UNLOCK(p); 870 crfree(newcred); 871 return (error); 872 } 873 874 #ifndef _SYS_SYSPROTO_H_ 875 struct setreuid_args { 876 uid_t ruid; 877 uid_t euid; 878 }; 879 #endif 880 /* ARGSUSED */ 881 int 882 sys_setreuid(struct thread *td, struct setreuid_args *uap) 883 { 884 struct proc *p = td->td_proc; 885 struct ucred *newcred, *oldcred; 886 uid_t euid, ruid; 887 struct uidinfo *euip, *ruip; 888 int error; 889 890 euid = uap->euid; 891 ruid = uap->ruid; 892 AUDIT_ARG_EUID(euid); 893 AUDIT_ARG_RUID(ruid); 894 newcred = crget(); 895 euip = uifind(euid); 896 ruip = uifind(ruid); 897 PROC_LOCK(p); 898 oldcred = crcopysafe(p, newcred); 899 900 #ifdef MAC 901 error = mac_cred_check_setreuid(oldcred, ruid, euid); 902 if (error) 903 goto fail; 904 #endif 905 906 if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid && 907 ruid != oldcred->cr_svuid) || 908 (euid != (uid_t)-1 && euid != oldcred->cr_uid && 909 euid != oldcred->cr_ruid && euid != oldcred->cr_svuid)) && 910 (error = priv_check_cred(oldcred, PRIV_CRED_SETREUID)) != 0) 911 goto fail; 912 913 if (euid != (uid_t)-1 && oldcred->cr_uid != euid) { 914 change_euid(newcred, euip); 915 setsugid(p); 916 } 917 if (ruid != (uid_t)-1 && oldcred->cr_ruid != ruid) { 918 change_ruid(newcred, ruip); 919 setsugid(p); 920 } 921 if ((ruid != (uid_t)-1 || newcred->cr_uid != newcred->cr_ruid) && 922 newcred->cr_svuid != newcred->cr_uid) { 923 change_svuid(newcred, newcred->cr_uid); 924 setsugid(p); 925 } 926 proc_set_cred(p, newcred); 927 #ifdef RACCT 928 racct_proc_ucred_changed(p, oldcred, newcred); 929 crhold(newcred); 930 #endif 931 PROC_UNLOCK(p); 932 #ifdef RCTL 933 rctl_proc_ucred_changed(p, newcred); 934 crfree(newcred); 935 #endif 936 uifree(ruip); 937 uifree(euip); 938 crfree(oldcred); 939 return (0); 940 941 fail: 942 PROC_UNLOCK(p); 943 uifree(ruip); 944 uifree(euip); 945 crfree(newcred); 946 return (error); 947 } 948 949 #ifndef _SYS_SYSPROTO_H_ 950 struct setregid_args { 951 gid_t rgid; 952 gid_t egid; 953 }; 954 #endif 955 /* ARGSUSED */ 956 int 957 sys_setregid(struct thread *td, struct setregid_args *uap) 958 { 959 struct proc *p = td->td_proc; 960 struct ucred *newcred, *oldcred; 961 gid_t egid, rgid; 962 int error; 963 964 egid = uap->egid; 965 rgid = uap->rgid; 966 AUDIT_ARG_EGID(egid); 967 AUDIT_ARG_RGID(rgid); 968 newcred = crget(); 969 PROC_LOCK(p); 970 oldcred = crcopysafe(p, newcred); 971 972 #ifdef MAC 973 error = mac_cred_check_setregid(oldcred, rgid, egid); 974 if (error) 975 goto fail; 976 #endif 977 978 if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid && 979 rgid != oldcred->cr_svgid) || 980 (egid != (gid_t)-1 && egid != oldcred->cr_groups[0] && 981 egid != oldcred->cr_rgid && egid != oldcred->cr_svgid)) && 982 (error = priv_check_cred(oldcred, PRIV_CRED_SETREGID)) != 0) 983 goto fail; 984 985 if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) { 986 change_egid(newcred, egid); 987 setsugid(p); 988 } 989 if (rgid != (gid_t)-1 && oldcred->cr_rgid != rgid) { 990 change_rgid(newcred, rgid); 991 setsugid(p); 992 } 993 if ((rgid != (gid_t)-1 || newcred->cr_groups[0] != newcred->cr_rgid) && 994 newcred->cr_svgid != newcred->cr_groups[0]) { 995 change_svgid(newcred, newcred->cr_groups[0]); 996 setsugid(p); 997 } 998 proc_set_cred(p, newcred); 999 PROC_UNLOCK(p); 1000 crfree(oldcred); 1001 return (0); 1002 1003 fail: 1004 PROC_UNLOCK(p); 1005 crfree(newcred); 1006 return (error); 1007 } 1008 1009 /* 1010 * setresuid(ruid, euid, suid) is like setreuid except control over the saved 1011 * uid is explicit. 1012 */ 1013 #ifndef _SYS_SYSPROTO_H_ 1014 struct setresuid_args { 1015 uid_t ruid; 1016 uid_t euid; 1017 uid_t suid; 1018 }; 1019 #endif 1020 /* ARGSUSED */ 1021 int 1022 sys_setresuid(struct thread *td, struct setresuid_args *uap) 1023 { 1024 struct proc *p = td->td_proc; 1025 struct ucred *newcred, *oldcred; 1026 uid_t euid, ruid, suid; 1027 struct uidinfo *euip, *ruip; 1028 int error; 1029 1030 euid = uap->euid; 1031 ruid = uap->ruid; 1032 suid = uap->suid; 1033 AUDIT_ARG_EUID(euid); 1034 AUDIT_ARG_RUID(ruid); 1035 AUDIT_ARG_SUID(suid); 1036 newcred = crget(); 1037 euip = uifind(euid); 1038 ruip = uifind(ruid); 1039 PROC_LOCK(p); 1040 oldcred = crcopysafe(p, newcred); 1041 1042 #ifdef MAC 1043 error = mac_cred_check_setresuid(oldcred, ruid, euid, suid); 1044 if (error) 1045 goto fail; 1046 #endif 1047 1048 if (((ruid != (uid_t)-1 && ruid != oldcred->cr_ruid && 1049 ruid != oldcred->cr_svuid && 1050 ruid != oldcred->cr_uid) || 1051 (euid != (uid_t)-1 && euid != oldcred->cr_ruid && 1052 euid != oldcred->cr_svuid && 1053 euid != oldcred->cr_uid) || 1054 (suid != (uid_t)-1 && suid != oldcred->cr_ruid && 1055 suid != oldcred->cr_svuid && 1056 suid != oldcred->cr_uid)) && 1057 (error = priv_check_cred(oldcred, PRIV_CRED_SETRESUID)) != 0) 1058 goto fail; 1059 1060 if (euid != (uid_t)-1 && oldcred->cr_uid != euid) { 1061 change_euid(newcred, euip); 1062 setsugid(p); 1063 } 1064 if (ruid != (uid_t)-1 && oldcred->cr_ruid != ruid) { 1065 change_ruid(newcred, ruip); 1066 setsugid(p); 1067 } 1068 if (suid != (uid_t)-1 && oldcred->cr_svuid != suid) { 1069 change_svuid(newcred, suid); 1070 setsugid(p); 1071 } 1072 proc_set_cred(p, newcred); 1073 #ifdef RACCT 1074 racct_proc_ucred_changed(p, oldcred, newcred); 1075 crhold(newcred); 1076 #endif 1077 PROC_UNLOCK(p); 1078 #ifdef RCTL 1079 rctl_proc_ucred_changed(p, newcred); 1080 crfree(newcred); 1081 #endif 1082 uifree(ruip); 1083 uifree(euip); 1084 crfree(oldcred); 1085 return (0); 1086 1087 fail: 1088 PROC_UNLOCK(p); 1089 uifree(ruip); 1090 uifree(euip); 1091 crfree(newcred); 1092 return (error); 1093 1094 } 1095 1096 /* 1097 * setresgid(rgid, egid, sgid) is like setregid except control over the saved 1098 * gid is explicit. 1099 */ 1100 #ifndef _SYS_SYSPROTO_H_ 1101 struct setresgid_args { 1102 gid_t rgid; 1103 gid_t egid; 1104 gid_t sgid; 1105 }; 1106 #endif 1107 /* ARGSUSED */ 1108 int 1109 sys_setresgid(struct thread *td, struct setresgid_args *uap) 1110 { 1111 struct proc *p = td->td_proc; 1112 struct ucred *newcred, *oldcred; 1113 gid_t egid, rgid, sgid; 1114 int error; 1115 1116 egid = uap->egid; 1117 rgid = uap->rgid; 1118 sgid = uap->sgid; 1119 AUDIT_ARG_EGID(egid); 1120 AUDIT_ARG_RGID(rgid); 1121 AUDIT_ARG_SGID(sgid); 1122 newcred = crget(); 1123 PROC_LOCK(p); 1124 oldcred = crcopysafe(p, newcred); 1125 1126 #ifdef MAC 1127 error = mac_cred_check_setresgid(oldcred, rgid, egid, sgid); 1128 if (error) 1129 goto fail; 1130 #endif 1131 1132 if (((rgid != (gid_t)-1 && rgid != oldcred->cr_rgid && 1133 rgid != oldcred->cr_svgid && 1134 rgid != oldcred->cr_groups[0]) || 1135 (egid != (gid_t)-1 && egid != oldcred->cr_rgid && 1136 egid != oldcred->cr_svgid && 1137 egid != oldcred->cr_groups[0]) || 1138 (sgid != (gid_t)-1 && sgid != oldcred->cr_rgid && 1139 sgid != oldcred->cr_svgid && 1140 sgid != oldcred->cr_groups[0])) && 1141 (error = priv_check_cred(oldcred, PRIV_CRED_SETRESGID)) != 0) 1142 goto fail; 1143 1144 if (egid != (gid_t)-1 && oldcred->cr_groups[0] != egid) { 1145 change_egid(newcred, egid); 1146 setsugid(p); 1147 } 1148 if (rgid != (gid_t)-1 && oldcred->cr_rgid != rgid) { 1149 change_rgid(newcred, rgid); 1150 setsugid(p); 1151 } 1152 if (sgid != (gid_t)-1 && oldcred->cr_svgid != sgid) { 1153 change_svgid(newcred, sgid); 1154 setsugid(p); 1155 } 1156 proc_set_cred(p, newcred); 1157 PROC_UNLOCK(p); 1158 crfree(oldcred); 1159 return (0); 1160 1161 fail: 1162 PROC_UNLOCK(p); 1163 crfree(newcred); 1164 return (error); 1165 } 1166 1167 #ifndef _SYS_SYSPROTO_H_ 1168 struct getresuid_args { 1169 uid_t *ruid; 1170 uid_t *euid; 1171 uid_t *suid; 1172 }; 1173 #endif 1174 /* ARGSUSED */ 1175 int 1176 sys_getresuid(struct thread *td, struct getresuid_args *uap) 1177 { 1178 struct ucred *cred; 1179 int error1 = 0, error2 = 0, error3 = 0; 1180 1181 cred = td->td_ucred; 1182 if (uap->ruid) 1183 error1 = copyout(&cred->cr_ruid, 1184 uap->ruid, sizeof(cred->cr_ruid)); 1185 if (uap->euid) 1186 error2 = copyout(&cred->cr_uid, 1187 uap->euid, sizeof(cred->cr_uid)); 1188 if (uap->suid) 1189 error3 = copyout(&cred->cr_svuid, 1190 uap->suid, sizeof(cred->cr_svuid)); 1191 return (error1 ? error1 : error2 ? error2 : error3); 1192 } 1193 1194 #ifndef _SYS_SYSPROTO_H_ 1195 struct getresgid_args { 1196 gid_t *rgid; 1197 gid_t *egid; 1198 gid_t *sgid; 1199 }; 1200 #endif 1201 /* ARGSUSED */ 1202 int 1203 sys_getresgid(struct thread *td, struct getresgid_args *uap) 1204 { 1205 struct ucred *cred; 1206 int error1 = 0, error2 = 0, error3 = 0; 1207 1208 cred = td->td_ucred; 1209 if (uap->rgid) 1210 error1 = copyout(&cred->cr_rgid, 1211 uap->rgid, sizeof(cred->cr_rgid)); 1212 if (uap->egid) 1213 error2 = copyout(&cred->cr_groups[0], 1214 uap->egid, sizeof(cred->cr_groups[0])); 1215 if (uap->sgid) 1216 error3 = copyout(&cred->cr_svgid, 1217 uap->sgid, sizeof(cred->cr_svgid)); 1218 return (error1 ? error1 : error2 ? error2 : error3); 1219 } 1220 1221 #ifndef _SYS_SYSPROTO_H_ 1222 struct issetugid_args { 1223 int dummy; 1224 }; 1225 #endif 1226 /* ARGSUSED */ 1227 int 1228 sys_issetugid(struct thread *td, struct issetugid_args *uap) 1229 { 1230 struct proc *p = td->td_proc; 1231 1232 /* 1233 * Note: OpenBSD sets a P_SUGIDEXEC flag set at execve() time, 1234 * we use P_SUGID because we consider changing the owners as 1235 * "tainting" as well. 1236 * This is significant for procs that start as root and "become" 1237 * a user without an exec - programs cannot know *everything* 1238 * that libc *might* have put in their data segment. 1239 */ 1240 td->td_retval[0] = (p->p_flag & P_SUGID) ? 1 : 0; 1241 return (0); 1242 } 1243 1244 int 1245 sys___setugid(struct thread *td, struct __setugid_args *uap) 1246 { 1247 #ifdef REGRESSION 1248 struct proc *p; 1249 1250 p = td->td_proc; 1251 switch (uap->flag) { 1252 case 0: 1253 PROC_LOCK(p); 1254 p->p_flag &= ~P_SUGID; 1255 PROC_UNLOCK(p); 1256 return (0); 1257 case 1: 1258 PROC_LOCK(p); 1259 p->p_flag |= P_SUGID; 1260 PROC_UNLOCK(p); 1261 return (0); 1262 default: 1263 return (EINVAL); 1264 } 1265 #else /* !REGRESSION */ 1266 1267 return (ENOSYS); 1268 #endif /* REGRESSION */ 1269 } 1270 1271 /* 1272 * Check if gid is a member of the group set. 1273 */ 1274 int 1275 groupmember(gid_t gid, struct ucred *cred) 1276 { 1277 int l; 1278 int h; 1279 int m; 1280 1281 if (cred->cr_groups[0] == gid) 1282 return(1); 1283 1284 /* 1285 * If gid was not our primary group, perform a binary search 1286 * of the supplemental groups. This is possible because we 1287 * sort the groups in crsetgroups(). 1288 */ 1289 l = 1; 1290 h = cred->cr_ngroups; 1291 while (l < h) { 1292 m = l + ((h - l) / 2); 1293 if (cred->cr_groups[m] < gid) 1294 l = m + 1; 1295 else 1296 h = m; 1297 } 1298 if ((l < cred->cr_ngroups) && (cred->cr_groups[l] == gid)) 1299 return (1); 1300 1301 return (0); 1302 } 1303 1304 /* 1305 * Test the active securelevel against a given level. securelevel_gt() 1306 * implements (securelevel > level). securelevel_ge() implements 1307 * (securelevel >= level). Note that the logic is inverted -- these 1308 * functions return EPERM on "success" and 0 on "failure". 1309 * 1310 * Due to care taken when setting the securelevel, we know that no jail will 1311 * be less secure that its parent (or the physical system), so it is sufficient 1312 * to test the current jail only. 1313 * 1314 * XXXRW: Possibly since this has to do with privilege, it should move to 1315 * kern_priv.c. 1316 */ 1317 int 1318 securelevel_gt(struct ucred *cr, int level) 1319 { 1320 1321 return (cr->cr_prison->pr_securelevel > level ? EPERM : 0); 1322 } 1323 1324 int 1325 securelevel_ge(struct ucred *cr, int level) 1326 { 1327 1328 return (cr->cr_prison->pr_securelevel >= level ? EPERM : 0); 1329 } 1330 1331 /* 1332 * 'see_other_uids' determines whether or not visibility of processes 1333 * and sockets with credentials holding different real uids is possible 1334 * using a variety of system MIBs. 1335 * XXX: data declarations should be together near the beginning of the file. 1336 */ 1337 static int see_other_uids = 1; 1338 SYSCTL_INT(_security_bsd, OID_AUTO, see_other_uids, CTLFLAG_RW, 1339 &see_other_uids, 0, 1340 "Unprivileged processes may see subjects/objects with different real uid"); 1341 1342 /*- 1343 * Determine if u1 "can see" the subject specified by u2, according to the 1344 * 'see_other_uids' policy. 1345 * Returns: 0 for permitted, ESRCH otherwise 1346 * Locks: none 1347 * References: *u1 and *u2 must not change during the call 1348 * u1 may equal u2, in which case only one reference is required 1349 */ 1350 int 1351 cr_canseeotheruids(struct ucred *u1, struct ucred *u2) 1352 { 1353 1354 if (!see_other_uids && u1->cr_ruid != u2->cr_ruid) { 1355 if (priv_check_cred(u1, PRIV_SEEOTHERUIDS) != 0) 1356 return (ESRCH); 1357 } 1358 return (0); 1359 } 1360 1361 /* 1362 * 'see_other_gids' determines whether or not visibility of processes 1363 * and sockets with credentials holding different real gids is possible 1364 * using a variety of system MIBs. 1365 * XXX: data declarations should be together near the beginning of the file. 1366 */ 1367 static int see_other_gids = 1; 1368 SYSCTL_INT(_security_bsd, OID_AUTO, see_other_gids, CTLFLAG_RW, 1369 &see_other_gids, 0, 1370 "Unprivileged processes may see subjects/objects with different real gid"); 1371 1372 /* 1373 * Determine if u1 can "see" the subject specified by u2, according to the 1374 * 'see_other_gids' policy. 1375 * Returns: 0 for permitted, ESRCH otherwise 1376 * Locks: none 1377 * References: *u1 and *u2 must not change during the call 1378 * u1 may equal u2, in which case only one reference is required 1379 */ 1380 int 1381 cr_canseeothergids(struct ucred *u1, struct ucred *u2) 1382 { 1383 int i, match; 1384 1385 if (!see_other_gids) { 1386 match = 0; 1387 for (i = 0; i < u1->cr_ngroups; i++) { 1388 if (groupmember(u1->cr_groups[i], u2)) 1389 match = 1; 1390 if (match) 1391 break; 1392 } 1393 if (!match) { 1394 if (priv_check_cred(u1, PRIV_SEEOTHERGIDS) != 0) 1395 return (ESRCH); 1396 } 1397 } 1398 return (0); 1399 } 1400 1401 /* 1402 * 'see_jail_proc' determines whether or not visibility of processes and 1403 * sockets with credentials holding different jail ids is possible using a 1404 * variety of system MIBs. 1405 * 1406 * XXX: data declarations should be together near the beginning of the file. 1407 */ 1408 1409 static int see_jail_proc = 1; 1410 SYSCTL_INT(_security_bsd, OID_AUTO, see_jail_proc, CTLFLAG_RW, 1411 &see_jail_proc, 0, 1412 "Unprivileged processes may see subjects/objects with different jail ids"); 1413 1414 /*- 1415 * Determine if u1 "can see" the subject specified by u2, according to the 1416 * 'see_jail_proc' policy. 1417 * Returns: 0 for permitted, ESRCH otherwise 1418 * Locks: none 1419 * References: *u1 and *u2 must not change during the call 1420 * u1 may equal u2, in which case only one reference is required 1421 */ 1422 int 1423 cr_canseejailproc(struct ucred *u1, struct ucred *u2) 1424 { 1425 if (u1->cr_uid == 0) 1426 return (0); 1427 return (!see_jail_proc && u1->cr_prison != u2->cr_prison ? ESRCH : 0); 1428 } 1429 1430 /*- 1431 * Determine if u1 "can see" the subject specified by u2. 1432 * Returns: 0 for permitted, an errno value otherwise 1433 * Locks: none 1434 * References: *u1 and *u2 must not change during the call 1435 * u1 may equal u2, in which case only one reference is required 1436 */ 1437 int 1438 cr_cansee(struct ucred *u1, struct ucred *u2) 1439 { 1440 int error; 1441 1442 if ((error = prison_check(u1, u2))) 1443 return (error); 1444 #ifdef MAC 1445 if ((error = mac_cred_check_visible(u1, u2))) 1446 return (error); 1447 #endif 1448 if ((error = cr_canseeotheruids(u1, u2))) 1449 return (error); 1450 if ((error = cr_canseeothergids(u1, u2))) 1451 return (error); 1452 if ((error = cr_canseejailproc(u1, u2))) 1453 return (error); 1454 return (0); 1455 } 1456 1457 /*- 1458 * Determine if td "can see" the subject specified by p. 1459 * Returns: 0 for permitted, an errno value otherwise 1460 * Locks: Sufficient locks to protect p->p_ucred must be held. td really 1461 * should be curthread. 1462 * References: td and p must be valid for the lifetime of the call 1463 */ 1464 int 1465 p_cansee(struct thread *td, struct proc *p) 1466 { 1467 1468 /* Wrap cr_cansee() for all functionality. */ 1469 KASSERT(td == curthread, ("%s: td not curthread", __func__)); 1470 PROC_LOCK_ASSERT(p, MA_OWNED); 1471 return (cr_cansee(td->td_ucred, p->p_ucred)); 1472 } 1473 1474 /* 1475 * 'conservative_signals' prevents the delivery of a broad class of 1476 * signals by unprivileged processes to processes that have changed their 1477 * credentials since the last invocation of execve(). This can prevent 1478 * the leakage of cached information or retained privileges as a result 1479 * of a common class of signal-related vulnerabilities. However, this 1480 * may interfere with some applications that expect to be able to 1481 * deliver these signals to peer processes after having given up 1482 * privilege. 1483 */ 1484 static int conservative_signals = 1; 1485 SYSCTL_INT(_security_bsd, OID_AUTO, conservative_signals, CTLFLAG_RW, 1486 &conservative_signals, 0, "Unprivileged processes prevented from " 1487 "sending certain signals to processes whose credentials have changed"); 1488 /*- 1489 * Determine whether cred may deliver the specified signal to proc. 1490 * Returns: 0 for permitted, an errno value otherwise. 1491 * Locks: A lock must be held for proc. 1492 * References: cred and proc must be valid for the lifetime of the call. 1493 */ 1494 int 1495 cr_cansignal(struct ucred *cred, struct proc *proc, int signum) 1496 { 1497 int error; 1498 1499 PROC_LOCK_ASSERT(proc, MA_OWNED); 1500 /* 1501 * Jail semantics limit the scope of signalling to proc in the 1502 * same jail as cred, if cred is in jail. 1503 */ 1504 error = prison_check(cred, proc->p_ucred); 1505 if (error) 1506 return (error); 1507 #ifdef MAC 1508 if ((error = mac_proc_check_signal(cred, proc, signum))) 1509 return (error); 1510 #endif 1511 if ((error = cr_canseeotheruids(cred, proc->p_ucred))) 1512 return (error); 1513 if ((error = cr_canseeothergids(cred, proc->p_ucred))) 1514 return (error); 1515 1516 /* 1517 * UNIX signal semantics depend on the status of the P_SUGID 1518 * bit on the target process. If the bit is set, then additional 1519 * restrictions are placed on the set of available signals. 1520 */ 1521 if (conservative_signals && (proc->p_flag & P_SUGID)) { 1522 switch (signum) { 1523 case 0: 1524 case SIGKILL: 1525 case SIGINT: 1526 case SIGTERM: 1527 case SIGALRM: 1528 case SIGSTOP: 1529 case SIGTTIN: 1530 case SIGTTOU: 1531 case SIGTSTP: 1532 case SIGHUP: 1533 case SIGUSR1: 1534 case SIGUSR2: 1535 /* 1536 * Generally, permit job and terminal control 1537 * signals. 1538 */ 1539 break; 1540 default: 1541 /* Not permitted without privilege. */ 1542 error = priv_check_cred(cred, PRIV_SIGNAL_SUGID); 1543 if (error) 1544 return (error); 1545 } 1546 } 1547 1548 /* 1549 * Generally, the target credential's ruid or svuid must match the 1550 * subject credential's ruid or euid. 1551 */ 1552 if (cred->cr_ruid != proc->p_ucred->cr_ruid && 1553 cred->cr_ruid != proc->p_ucred->cr_svuid && 1554 cred->cr_uid != proc->p_ucred->cr_ruid && 1555 cred->cr_uid != proc->p_ucred->cr_svuid) { 1556 error = priv_check_cred(cred, PRIV_SIGNAL_DIFFCRED); 1557 if (error) 1558 return (error); 1559 } 1560 1561 return (0); 1562 } 1563 1564 /*- 1565 * Determine whether td may deliver the specified signal to p. 1566 * Returns: 0 for permitted, an errno value otherwise 1567 * Locks: Sufficient locks to protect various components of td and p 1568 * must be held. td must be curthread, and a lock must be 1569 * held for p. 1570 * References: td and p must be valid for the lifetime of the call 1571 */ 1572 int 1573 p_cansignal(struct thread *td, struct proc *p, int signum) 1574 { 1575 1576 KASSERT(td == curthread, ("%s: td not curthread", __func__)); 1577 PROC_LOCK_ASSERT(p, MA_OWNED); 1578 if (td->td_proc == p) 1579 return (0); 1580 1581 /* 1582 * UNIX signalling semantics require that processes in the same 1583 * session always be able to deliver SIGCONT to one another, 1584 * overriding the remaining protections. 1585 */ 1586 /* XXX: This will require an additional lock of some sort. */ 1587 if (signum == SIGCONT && td->td_proc->p_session == p->p_session) 1588 return (0); 1589 /* 1590 * Some compat layers use SIGTHR and higher signals for 1591 * communication between different kernel threads of the same 1592 * process, so that they expect that it's always possible to 1593 * deliver them, even for suid applications where cr_cansignal() can 1594 * deny such ability for security consideration. It should be 1595 * pretty safe to do since the only way to create two processes 1596 * with the same p_leader is via rfork(2). 1597 */ 1598 if (td->td_proc->p_leader != NULL && signum >= SIGTHR && 1599 signum < SIGTHR + 4 && td->td_proc->p_leader == p->p_leader) 1600 return (0); 1601 1602 return (cr_cansignal(td->td_ucred, p, signum)); 1603 } 1604 1605 /*- 1606 * Determine whether td may reschedule p. 1607 * Returns: 0 for permitted, an errno value otherwise 1608 * Locks: Sufficient locks to protect various components of td and p 1609 * must be held. td must be curthread, and a lock must 1610 * be held for p. 1611 * References: td and p must be valid for the lifetime of the call 1612 */ 1613 int 1614 p_cansched(struct thread *td, struct proc *p) 1615 { 1616 int error; 1617 1618 KASSERT(td == curthread, ("%s: td not curthread", __func__)); 1619 PROC_LOCK_ASSERT(p, MA_OWNED); 1620 if (td->td_proc == p) 1621 return (0); 1622 if ((error = prison_check(td->td_ucred, p->p_ucred))) 1623 return (error); 1624 #ifdef MAC 1625 if ((error = mac_proc_check_sched(td->td_ucred, p))) 1626 return (error); 1627 #endif 1628 if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred))) 1629 return (error); 1630 if ((error = cr_canseeothergids(td->td_ucred, p->p_ucred))) 1631 return (error); 1632 if (td->td_ucred->cr_ruid != p->p_ucred->cr_ruid && 1633 td->td_ucred->cr_uid != p->p_ucred->cr_ruid) { 1634 error = priv_check(td, PRIV_SCHED_DIFFCRED); 1635 if (error) 1636 return (error); 1637 } 1638 return (0); 1639 } 1640 1641 /* 1642 * Handle getting or setting the prison's unprivileged_proc_debug 1643 * value. 1644 */ 1645 static int 1646 sysctl_unprivileged_proc_debug(SYSCTL_HANDLER_ARGS) 1647 { 1648 struct prison *pr; 1649 int error, val; 1650 1651 val = prison_allow(req->td->td_ucred, PR_ALLOW_UNPRIV_DEBUG) != 0; 1652 error = sysctl_handle_int(oidp, &val, 0, req); 1653 if (error != 0 || req->newptr == NULL) 1654 return (error); 1655 pr = req->td->td_ucred->cr_prison; 1656 mtx_lock(&pr->pr_mtx); 1657 switch (val) { 1658 case 0: 1659 pr->pr_allow &= ~(PR_ALLOW_UNPRIV_DEBUG); 1660 break; 1661 case 1: 1662 pr->pr_allow |= PR_ALLOW_UNPRIV_DEBUG; 1663 break; 1664 default: 1665 error = EINVAL; 1666 } 1667 mtx_unlock(&pr->pr_mtx); 1668 1669 return (error); 1670 } 1671 1672 /* 1673 * The 'unprivileged_proc_debug' flag may be used to disable a variety of 1674 * unprivileged inter-process debugging services, including some procfs 1675 * functionality, ptrace(), and ktrace(). In the past, inter-process 1676 * debugging has been involved in a variety of security problems, and sites 1677 * not requiring the service might choose to disable it when hardening 1678 * systems. 1679 */ 1680 SYSCTL_PROC(_security_bsd, OID_AUTO, unprivileged_proc_debug, 1681 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_PRISON | CTLFLAG_SECURE | 1682 CTLFLAG_MPSAFE, 0, 0, sysctl_unprivileged_proc_debug, "I", 1683 "Unprivileged processes may use process debugging facilities"); 1684 1685 /*- 1686 * Determine whether td may debug p. 1687 * Returns: 0 for permitted, an errno value otherwise 1688 * Locks: Sufficient locks to protect various components of td and p 1689 * must be held. td must be curthread, and a lock must 1690 * be held for p. 1691 * References: td and p must be valid for the lifetime of the call 1692 */ 1693 int 1694 p_candebug(struct thread *td, struct proc *p) 1695 { 1696 int credentialchanged, error, grpsubset, i, uidsubset; 1697 1698 KASSERT(td == curthread, ("%s: td not curthread", __func__)); 1699 PROC_LOCK_ASSERT(p, MA_OWNED); 1700 if ((error = priv_check(td, PRIV_DEBUG_UNPRIV))) 1701 return (error); 1702 if (td->td_proc == p) 1703 return (0); 1704 if ((error = prison_check(td->td_ucred, p->p_ucred))) 1705 return (error); 1706 #ifdef MAC 1707 if ((error = mac_proc_check_debug(td->td_ucred, p))) 1708 return (error); 1709 #endif 1710 if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred))) 1711 return (error); 1712 if ((error = cr_canseeothergids(td->td_ucred, p->p_ucred))) 1713 return (error); 1714 1715 /* 1716 * Is p's group set a subset of td's effective group set? This 1717 * includes p's egid, group access list, rgid, and svgid. 1718 */ 1719 grpsubset = 1; 1720 for (i = 0; i < p->p_ucred->cr_ngroups; i++) { 1721 if (!groupmember(p->p_ucred->cr_groups[i], td->td_ucred)) { 1722 grpsubset = 0; 1723 break; 1724 } 1725 } 1726 grpsubset = grpsubset && 1727 groupmember(p->p_ucred->cr_rgid, td->td_ucred) && 1728 groupmember(p->p_ucred->cr_svgid, td->td_ucred); 1729 1730 /* 1731 * Are the uids present in p's credential equal to td's 1732 * effective uid? This includes p's euid, svuid, and ruid. 1733 */ 1734 uidsubset = (td->td_ucred->cr_uid == p->p_ucred->cr_uid && 1735 td->td_ucred->cr_uid == p->p_ucred->cr_svuid && 1736 td->td_ucred->cr_uid == p->p_ucred->cr_ruid); 1737 1738 /* 1739 * Has the credential of the process changed since the last exec()? 1740 */ 1741 credentialchanged = (p->p_flag & P_SUGID); 1742 1743 /* 1744 * If p's gids aren't a subset, or the uids aren't a subset, 1745 * or the credential has changed, require appropriate privilege 1746 * for td to debug p. 1747 */ 1748 if (!grpsubset || !uidsubset) { 1749 error = priv_check(td, PRIV_DEBUG_DIFFCRED); 1750 if (error) 1751 return (error); 1752 } 1753 1754 if (credentialchanged) { 1755 error = priv_check(td, PRIV_DEBUG_SUGID); 1756 if (error) 1757 return (error); 1758 } 1759 1760 /* Can't trace init when securelevel > 0. */ 1761 if (p == initproc) { 1762 error = securelevel_gt(td->td_ucred, 0); 1763 if (error) 1764 return (error); 1765 } 1766 1767 /* 1768 * Can't trace a process that's currently exec'ing. 1769 * 1770 * XXX: Note, this is not a security policy decision, it's a 1771 * basic correctness/functionality decision. Therefore, this check 1772 * should be moved to the caller's of p_candebug(). 1773 */ 1774 if ((p->p_flag & P_INEXEC) != 0) 1775 return (EBUSY); 1776 1777 /* Denied explicitely */ 1778 if ((p->p_flag2 & P2_NOTRACE) != 0) { 1779 error = priv_check(td, PRIV_DEBUG_DENIED); 1780 if (error != 0) 1781 return (error); 1782 } 1783 1784 return (0); 1785 } 1786 1787 /*- 1788 * Determine whether the subject represented by cred can "see" a socket. 1789 * Returns: 0 for permitted, ENOENT otherwise. 1790 */ 1791 int 1792 cr_canseesocket(struct ucred *cred, struct socket *so) 1793 { 1794 int error; 1795 1796 error = prison_check(cred, so->so_cred); 1797 if (error) 1798 return (ENOENT); 1799 #ifdef MAC 1800 error = mac_socket_check_visible(cred, so); 1801 if (error) 1802 return (error); 1803 #endif 1804 if (cr_canseeotheruids(cred, so->so_cred)) 1805 return (ENOENT); 1806 if (cr_canseeothergids(cred, so->so_cred)) 1807 return (ENOENT); 1808 1809 return (0); 1810 } 1811 1812 /*- 1813 * Determine whether td can wait for the exit of p. 1814 * Returns: 0 for permitted, an errno value otherwise 1815 * Locks: Sufficient locks to protect various components of td and p 1816 * must be held. td must be curthread, and a lock must 1817 * be held for p. 1818 * References: td and p must be valid for the lifetime of the call 1819 1820 */ 1821 int 1822 p_canwait(struct thread *td, struct proc *p) 1823 { 1824 int error; 1825 1826 KASSERT(td == curthread, ("%s: td not curthread", __func__)); 1827 PROC_LOCK_ASSERT(p, MA_OWNED); 1828 if ((error = prison_check(td->td_ucred, p->p_ucred))) 1829 return (error); 1830 #ifdef MAC 1831 if ((error = mac_proc_check_wait(td->td_ucred, p))) 1832 return (error); 1833 #endif 1834 #if 0 1835 /* XXXMAC: This could have odd effects on some shells. */ 1836 if ((error = cr_canseeotheruids(td->td_ucred, p->p_ucred))) 1837 return (error); 1838 #endif 1839 1840 return (0); 1841 } 1842 1843 /* 1844 * Allocate a zeroed cred structure. 1845 */ 1846 struct ucred * 1847 crget(void) 1848 { 1849 struct ucred *cr; 1850 1851 cr = malloc(sizeof(*cr), M_CRED, M_WAITOK | M_ZERO); 1852 refcount_init(&cr->cr_ref, 1); 1853 #ifdef AUDIT 1854 audit_cred_init(cr); 1855 #endif 1856 #ifdef MAC 1857 mac_cred_init(cr); 1858 #endif 1859 cr->cr_groups = cr->cr_smallgroups; 1860 cr->cr_agroups = 1861 sizeof(cr->cr_smallgroups) / sizeof(cr->cr_smallgroups[0]); 1862 return (cr); 1863 } 1864 1865 /* 1866 * Claim another reference to a ucred structure. 1867 */ 1868 struct ucred * 1869 crhold(struct ucred *cr) 1870 { 1871 1872 refcount_acquire(&cr->cr_ref); 1873 return (cr); 1874 } 1875 1876 /* 1877 * Free a cred structure. Throws away space when ref count gets to 0. 1878 */ 1879 void 1880 crfree(struct ucred *cr) 1881 { 1882 1883 KASSERT(cr->cr_ref > 0, ("bad ucred refcount: %d", cr->cr_ref)); 1884 KASSERT(cr->cr_ref != 0xdeadc0de, ("dangling reference to ucred")); 1885 if (refcount_release(&cr->cr_ref)) { 1886 /* 1887 * Some callers of crget(), such as nfs_statfs(), 1888 * allocate a temporary credential, but don't 1889 * allocate a uidinfo structure. 1890 */ 1891 if (cr->cr_uidinfo != NULL) 1892 uifree(cr->cr_uidinfo); 1893 if (cr->cr_ruidinfo != NULL) 1894 uifree(cr->cr_ruidinfo); 1895 /* 1896 * Free a prison, if any. 1897 */ 1898 if (cr->cr_prison != NULL) 1899 prison_free(cr->cr_prison); 1900 if (cr->cr_loginclass != NULL) 1901 loginclass_free(cr->cr_loginclass); 1902 #ifdef AUDIT 1903 audit_cred_destroy(cr); 1904 #endif 1905 #ifdef MAC 1906 mac_cred_destroy(cr); 1907 #endif 1908 if (cr->cr_groups != cr->cr_smallgroups) 1909 free(cr->cr_groups, M_CRED); 1910 free(cr, M_CRED); 1911 } 1912 } 1913 1914 /* 1915 * Copy a ucred's contents from a template. Does not block. 1916 */ 1917 void 1918 crcopy(struct ucred *dest, struct ucred *src) 1919 { 1920 1921 KASSERT(dest->cr_ref == 1, ("crcopy of shared ucred")); 1922 bcopy(&src->cr_startcopy, &dest->cr_startcopy, 1923 (unsigned)((caddr_t)&src->cr_endcopy - 1924 (caddr_t)&src->cr_startcopy)); 1925 crsetgroups(dest, src->cr_ngroups, src->cr_groups); 1926 uihold(dest->cr_uidinfo); 1927 uihold(dest->cr_ruidinfo); 1928 prison_hold(dest->cr_prison); 1929 loginclass_hold(dest->cr_loginclass); 1930 #ifdef AUDIT 1931 audit_cred_copy(src, dest); 1932 #endif 1933 #ifdef MAC 1934 mac_cred_copy(src, dest); 1935 #endif 1936 } 1937 1938 /* 1939 * Dup cred struct to a new held one. 1940 */ 1941 struct ucred * 1942 crdup(struct ucred *cr) 1943 { 1944 struct ucred *newcr; 1945 1946 newcr = crget(); 1947 crcopy(newcr, cr); 1948 return (newcr); 1949 } 1950 1951 /* 1952 * Fill in a struct xucred based on a struct ucred. 1953 */ 1954 void 1955 cru2x(struct ucred *cr, struct xucred *xcr) 1956 { 1957 int ngroups; 1958 1959 bzero(xcr, sizeof(*xcr)); 1960 xcr->cr_version = XUCRED_VERSION; 1961 xcr->cr_uid = cr->cr_uid; 1962 1963 ngroups = MIN(cr->cr_ngroups, XU_NGROUPS); 1964 xcr->cr_ngroups = ngroups; 1965 bcopy(cr->cr_groups, xcr->cr_groups, 1966 ngroups * sizeof(*cr->cr_groups)); 1967 } 1968 1969 void 1970 cru2xt(struct thread *td, struct xucred *xcr) 1971 { 1972 1973 cru2x(td->td_ucred, xcr); 1974 xcr->cr_pid = td->td_proc->p_pid; 1975 } 1976 1977 /* 1978 * Set initial process credentials. 1979 * Callers are responsible for providing the reference for provided credentials. 1980 */ 1981 void 1982 proc_set_cred_init(struct proc *p, struct ucred *newcred) 1983 { 1984 1985 p->p_ucred = newcred; 1986 } 1987 1988 /* 1989 * Change process credentials. 1990 * Callers are responsible for providing the reference for passed credentials 1991 * and for freeing old ones. 1992 * 1993 * Process has to be locked except when it does not have credentials (as it 1994 * should not be visible just yet) or when newcred is NULL (as this can be 1995 * only used when the process is about to be freed, at which point it should 1996 * not be visible anymore). 1997 */ 1998 void 1999 proc_set_cred(struct proc *p, struct ucred *newcred) 2000 { 2001 2002 MPASS(p->p_ucred != NULL); 2003 if (newcred == NULL) 2004 MPASS(p->p_state == PRS_ZOMBIE); 2005 else 2006 PROC_LOCK_ASSERT(p, MA_OWNED); 2007 2008 p->p_ucred = newcred; 2009 if (newcred != NULL) 2010 PROC_UPDATE_COW(p); 2011 } 2012 2013 struct ucred * 2014 crcopysafe(struct proc *p, struct ucred *cr) 2015 { 2016 struct ucred *oldcred; 2017 int groups; 2018 2019 PROC_LOCK_ASSERT(p, MA_OWNED); 2020 2021 oldcred = p->p_ucred; 2022 while (cr->cr_agroups < oldcred->cr_agroups) { 2023 groups = oldcred->cr_agroups; 2024 PROC_UNLOCK(p); 2025 crextend(cr, groups); 2026 PROC_LOCK(p); 2027 oldcred = p->p_ucred; 2028 } 2029 crcopy(cr, oldcred); 2030 2031 return (oldcred); 2032 } 2033 2034 /* 2035 * Extend the passed in credential to hold n items. 2036 */ 2037 void 2038 crextend(struct ucred *cr, int n) 2039 { 2040 int cnt; 2041 2042 /* Truncate? */ 2043 if (n <= cr->cr_agroups) 2044 return; 2045 2046 /* 2047 * We extend by 2 each time since we're using a power of two 2048 * allocator until we need enough groups to fill a page. 2049 * Once we're allocating multiple pages, only allocate as many 2050 * as we actually need. The case of processes needing a 2051 * non-power of two number of pages seems more likely than 2052 * a real world process that adds thousands of groups one at a 2053 * time. 2054 */ 2055 if ( n < PAGE_SIZE / sizeof(gid_t) ) { 2056 if (cr->cr_agroups == 0) 2057 cnt = MAX(1, MINALLOCSIZE / sizeof(gid_t)); 2058 else 2059 cnt = cr->cr_agroups * 2; 2060 2061 while (cnt < n) 2062 cnt *= 2; 2063 } else 2064 cnt = roundup2(n, PAGE_SIZE / sizeof(gid_t)); 2065 2066 /* Free the old array. */ 2067 if (cr->cr_groups != cr->cr_smallgroups) 2068 free(cr->cr_groups, M_CRED); 2069 2070 cr->cr_groups = malloc(cnt * sizeof(gid_t), M_CRED, M_WAITOK | M_ZERO); 2071 cr->cr_agroups = cnt; 2072 } 2073 2074 /* 2075 * Copy groups in to a credential, preserving any necessary invariants. 2076 * Currently this includes the sorting of all supplemental gids. 2077 * crextend() must have been called before hand to ensure sufficient 2078 * space is available. 2079 */ 2080 static void 2081 crsetgroups_locked(struct ucred *cr, int ngrp, gid_t *groups) 2082 { 2083 int i; 2084 int j; 2085 gid_t g; 2086 2087 KASSERT(cr->cr_agroups >= ngrp, ("cr_ngroups is too small")); 2088 2089 bcopy(groups, cr->cr_groups, ngrp * sizeof(gid_t)); 2090 cr->cr_ngroups = ngrp; 2091 2092 /* 2093 * Sort all groups except cr_groups[0] to allow groupmember to 2094 * perform a binary search. 2095 * 2096 * XXX: If large numbers of groups become common this should 2097 * be replaced with shell sort like linux uses or possibly 2098 * heap sort. 2099 */ 2100 for (i = 2; i < ngrp; i++) { 2101 g = cr->cr_groups[i]; 2102 for (j = i-1; j >= 1 && g < cr->cr_groups[j]; j--) 2103 cr->cr_groups[j + 1] = cr->cr_groups[j]; 2104 cr->cr_groups[j + 1] = g; 2105 } 2106 } 2107 2108 /* 2109 * Copy groups in to a credential after expanding it if required. 2110 * Truncate the list to (ngroups_max + 1) if it is too large. 2111 */ 2112 void 2113 crsetgroups(struct ucred *cr, int ngrp, gid_t *groups) 2114 { 2115 2116 if (ngrp > ngroups_max + 1) 2117 ngrp = ngroups_max + 1; 2118 2119 crextend(cr, ngrp); 2120 crsetgroups_locked(cr, ngrp, groups); 2121 } 2122 2123 /* 2124 * Get login name, if available. 2125 */ 2126 #ifndef _SYS_SYSPROTO_H_ 2127 struct getlogin_args { 2128 char *namebuf; 2129 u_int namelen; 2130 }; 2131 #endif 2132 /* ARGSUSED */ 2133 int 2134 sys_getlogin(struct thread *td, struct getlogin_args *uap) 2135 { 2136 char login[MAXLOGNAME]; 2137 struct proc *p = td->td_proc; 2138 size_t len; 2139 2140 if (uap->namelen > MAXLOGNAME) 2141 uap->namelen = MAXLOGNAME; 2142 PROC_LOCK(p); 2143 SESS_LOCK(p->p_session); 2144 len = strlcpy(login, p->p_session->s_login, uap->namelen) + 1; 2145 SESS_UNLOCK(p->p_session); 2146 PROC_UNLOCK(p); 2147 if (len > uap->namelen) 2148 return (ERANGE); 2149 return (copyout(login, uap->namebuf, len)); 2150 } 2151 2152 /* 2153 * Set login name. 2154 */ 2155 #ifndef _SYS_SYSPROTO_H_ 2156 struct setlogin_args { 2157 char *namebuf; 2158 }; 2159 #endif 2160 /* ARGSUSED */ 2161 int 2162 sys_setlogin(struct thread *td, struct setlogin_args *uap) 2163 { 2164 struct proc *p = td->td_proc; 2165 int error; 2166 char logintmp[MAXLOGNAME]; 2167 2168 CTASSERT(sizeof(p->p_session->s_login) >= sizeof(logintmp)); 2169 2170 error = priv_check(td, PRIV_PROC_SETLOGIN); 2171 if (error) 2172 return (error); 2173 error = copyinstr(uap->namebuf, logintmp, sizeof(logintmp), NULL); 2174 if (error != 0) { 2175 if (error == ENAMETOOLONG) 2176 error = EINVAL; 2177 return (error); 2178 } 2179 AUDIT_ARG_LOGIN(logintmp); 2180 PROC_LOCK(p); 2181 SESS_LOCK(p->p_session); 2182 strcpy(p->p_session->s_login, logintmp); 2183 SESS_UNLOCK(p->p_session); 2184 PROC_UNLOCK(p); 2185 return (0); 2186 } 2187 2188 void 2189 setsugid(struct proc *p) 2190 { 2191 2192 PROC_LOCK_ASSERT(p, MA_OWNED); 2193 p->p_flag |= P_SUGID; 2194 } 2195 2196 /*- 2197 * Change a process's effective uid. 2198 * Side effects: newcred->cr_uid and newcred->cr_uidinfo will be modified. 2199 * References: newcred must be an exclusive credential reference for the 2200 * duration of the call. 2201 */ 2202 void 2203 change_euid(struct ucred *newcred, struct uidinfo *euip) 2204 { 2205 2206 newcred->cr_uid = euip->ui_uid; 2207 uihold(euip); 2208 uifree(newcred->cr_uidinfo); 2209 newcred->cr_uidinfo = euip; 2210 } 2211 2212 /*- 2213 * Change a process's effective gid. 2214 * Side effects: newcred->cr_gid will be modified. 2215 * References: newcred must be an exclusive credential reference for the 2216 * duration of the call. 2217 */ 2218 void 2219 change_egid(struct ucred *newcred, gid_t egid) 2220 { 2221 2222 newcred->cr_groups[0] = egid; 2223 } 2224 2225 /*- 2226 * Change a process's real uid. 2227 * Side effects: newcred->cr_ruid will be updated, newcred->cr_ruidinfo 2228 * will be updated, and the old and new cr_ruidinfo proc 2229 * counts will be updated. 2230 * References: newcred must be an exclusive credential reference for the 2231 * duration of the call. 2232 */ 2233 void 2234 change_ruid(struct ucred *newcred, struct uidinfo *ruip) 2235 { 2236 2237 (void)chgproccnt(newcred->cr_ruidinfo, -1, 0); 2238 newcred->cr_ruid = ruip->ui_uid; 2239 uihold(ruip); 2240 uifree(newcred->cr_ruidinfo); 2241 newcred->cr_ruidinfo = ruip; 2242 (void)chgproccnt(newcred->cr_ruidinfo, 1, 0); 2243 } 2244 2245 /*- 2246 * Change a process's real gid. 2247 * Side effects: newcred->cr_rgid will be updated. 2248 * References: newcred must be an exclusive credential reference for the 2249 * duration of the call. 2250 */ 2251 void 2252 change_rgid(struct ucred *newcred, gid_t rgid) 2253 { 2254 2255 newcred->cr_rgid = rgid; 2256 } 2257 2258 /*- 2259 * Change a process's saved uid. 2260 * Side effects: newcred->cr_svuid will be updated. 2261 * References: newcred must be an exclusive credential reference for the 2262 * duration of the call. 2263 */ 2264 void 2265 change_svuid(struct ucred *newcred, uid_t svuid) 2266 { 2267 2268 newcred->cr_svuid = svuid; 2269 } 2270 2271 /*- 2272 * Change a process's saved gid. 2273 * Side effects: newcred->cr_svgid will be updated. 2274 * References: newcred must be an exclusive credential reference for the 2275 * duration of the call. 2276 */ 2277 void 2278 change_svgid(struct ucred *newcred, gid_t svgid) 2279 { 2280 2281 newcred->cr_svgid = svgid; 2282 } 2283