1*e3b3d0f5SGreg Kroah-Hartman // SPDX-License-Identifier: GPL-2.0 2a1235b3eSNicolas Pitre /* 3a1235b3eSNicolas Pitre * Copyright (C) 1991, 1992 Linus Torvalds 4a1235b3eSNicolas Pitre */ 5a1235b3eSNicolas Pitre 6a1235b3eSNicolas Pitre #include <linux/types.h> 7a1235b3eSNicolas Pitre #include <linux/errno.h> 8a1235b3eSNicolas Pitre #include <linux/signal.h> 9a1235b3eSNicolas Pitre #include <linux/sched/signal.h> 10a1235b3eSNicolas Pitre #include <linux/sched/task.h> 11a1235b3eSNicolas Pitre #include <linux/tty.h> 12a1235b3eSNicolas Pitre #include <linux/fcntl.h> 13a1235b3eSNicolas Pitre #include <linux/uaccess.h> 14a1235b3eSNicolas Pitre 15a1235b3eSNicolas Pitre static int is_ignored(int sig) 16a1235b3eSNicolas Pitre { 17a1235b3eSNicolas Pitre return (sigismember(¤t->blocked, sig) || 18a1235b3eSNicolas Pitre current->sighand->action[sig-1].sa.sa_handler == SIG_IGN); 19a1235b3eSNicolas Pitre } 20a1235b3eSNicolas Pitre 21a1235b3eSNicolas Pitre /** 22a1235b3eSNicolas Pitre * tty_check_change - check for POSIX terminal changes 23a1235b3eSNicolas Pitre * @tty: tty to check 24a1235b3eSNicolas Pitre * 25a1235b3eSNicolas Pitre * If we try to write to, or set the state of, a terminal and we're 26a1235b3eSNicolas Pitre * not in the foreground, send a SIGTTOU. If the signal is blocked or 27a1235b3eSNicolas Pitre * ignored, go ahead and perform the operation. (POSIX 7.2) 28a1235b3eSNicolas Pitre * 29a1235b3eSNicolas Pitre * Locking: ctrl_lock 30a1235b3eSNicolas Pitre */ 31a1235b3eSNicolas Pitre int __tty_check_change(struct tty_struct *tty, int sig) 32a1235b3eSNicolas Pitre { 33a1235b3eSNicolas Pitre unsigned long flags; 34a1235b3eSNicolas Pitre struct pid *pgrp, *tty_pgrp; 35a1235b3eSNicolas Pitre int ret = 0; 36a1235b3eSNicolas Pitre 37a1235b3eSNicolas Pitre if (current->signal->tty != tty) 38a1235b3eSNicolas Pitre return 0; 39a1235b3eSNicolas Pitre 40a1235b3eSNicolas Pitre rcu_read_lock(); 41a1235b3eSNicolas Pitre pgrp = task_pgrp(current); 42a1235b3eSNicolas Pitre 43a1235b3eSNicolas Pitre spin_lock_irqsave(&tty->ctrl_lock, flags); 44a1235b3eSNicolas Pitre tty_pgrp = tty->pgrp; 45a1235b3eSNicolas Pitre spin_unlock_irqrestore(&tty->ctrl_lock, flags); 46a1235b3eSNicolas Pitre 47a1235b3eSNicolas Pitre if (tty_pgrp && pgrp != tty->pgrp) { 48a1235b3eSNicolas Pitre if (is_ignored(sig)) { 49a1235b3eSNicolas Pitre if (sig == SIGTTIN) 50a1235b3eSNicolas Pitre ret = -EIO; 51a1235b3eSNicolas Pitre } else if (is_current_pgrp_orphaned()) 52a1235b3eSNicolas Pitre ret = -EIO; 53a1235b3eSNicolas Pitre else { 54a1235b3eSNicolas Pitre kill_pgrp(pgrp, sig, 1); 55a1235b3eSNicolas Pitre set_thread_flag(TIF_SIGPENDING); 56a1235b3eSNicolas Pitre ret = -ERESTARTSYS; 57a1235b3eSNicolas Pitre } 58a1235b3eSNicolas Pitre } 59a1235b3eSNicolas Pitre rcu_read_unlock(); 60a1235b3eSNicolas Pitre 61a1235b3eSNicolas Pitre if (!tty_pgrp) 62a1235b3eSNicolas Pitre tty_warn(tty, "sig=%d, tty->pgrp == NULL!\n", sig); 63a1235b3eSNicolas Pitre 64a1235b3eSNicolas Pitre return ret; 65a1235b3eSNicolas Pitre } 66a1235b3eSNicolas Pitre 67a1235b3eSNicolas Pitre int tty_check_change(struct tty_struct *tty) 68a1235b3eSNicolas Pitre { 69a1235b3eSNicolas Pitre return __tty_check_change(tty, SIGTTOU); 70a1235b3eSNicolas Pitre } 71a1235b3eSNicolas Pitre EXPORT_SYMBOL(tty_check_change); 72a1235b3eSNicolas Pitre 73a1235b3eSNicolas Pitre void proc_clear_tty(struct task_struct *p) 74a1235b3eSNicolas Pitre { 75a1235b3eSNicolas Pitre unsigned long flags; 76a1235b3eSNicolas Pitre struct tty_struct *tty; 77a1235b3eSNicolas Pitre spin_lock_irqsave(&p->sighand->siglock, flags); 78a1235b3eSNicolas Pitre tty = p->signal->tty; 79a1235b3eSNicolas Pitre p->signal->tty = NULL; 80a1235b3eSNicolas Pitre spin_unlock_irqrestore(&p->sighand->siglock, flags); 81a1235b3eSNicolas Pitre tty_kref_put(tty); 82a1235b3eSNicolas Pitre } 83a1235b3eSNicolas Pitre 84a1235b3eSNicolas Pitre /** 85a1235b3eSNicolas Pitre * proc_set_tty - set the controlling terminal 86a1235b3eSNicolas Pitre * 87a1235b3eSNicolas Pitre * Only callable by the session leader and only if it does not already have 88a1235b3eSNicolas Pitre * a controlling terminal. 89a1235b3eSNicolas Pitre * 90a1235b3eSNicolas Pitre * Caller must hold: tty_lock() 91a1235b3eSNicolas Pitre * a readlock on tasklist_lock 92a1235b3eSNicolas Pitre * sighand lock 93a1235b3eSNicolas Pitre */ 94a1235b3eSNicolas Pitre static void __proc_set_tty(struct tty_struct *tty) 95a1235b3eSNicolas Pitre { 96a1235b3eSNicolas Pitre unsigned long flags; 97a1235b3eSNicolas Pitre 98a1235b3eSNicolas Pitre spin_lock_irqsave(&tty->ctrl_lock, flags); 99a1235b3eSNicolas Pitre /* 100a1235b3eSNicolas Pitre * The session and fg pgrp references will be non-NULL if 101a1235b3eSNicolas Pitre * tiocsctty() is stealing the controlling tty 102a1235b3eSNicolas Pitre */ 103a1235b3eSNicolas Pitre put_pid(tty->session); 104a1235b3eSNicolas Pitre put_pid(tty->pgrp); 105a1235b3eSNicolas Pitre tty->pgrp = get_pid(task_pgrp(current)); 106a1235b3eSNicolas Pitre spin_unlock_irqrestore(&tty->ctrl_lock, flags); 107a1235b3eSNicolas Pitre tty->session = get_pid(task_session(current)); 108a1235b3eSNicolas Pitre if (current->signal->tty) { 109a1235b3eSNicolas Pitre tty_debug(tty, "current tty %s not NULL!!\n", 110a1235b3eSNicolas Pitre current->signal->tty->name); 111a1235b3eSNicolas Pitre tty_kref_put(current->signal->tty); 112a1235b3eSNicolas Pitre } 113a1235b3eSNicolas Pitre put_pid(current->signal->tty_old_pgrp); 114a1235b3eSNicolas Pitre current->signal->tty = tty_kref_get(tty); 115a1235b3eSNicolas Pitre current->signal->tty_old_pgrp = NULL; 116a1235b3eSNicolas Pitre } 117a1235b3eSNicolas Pitre 118a1235b3eSNicolas Pitre static void proc_set_tty(struct tty_struct *tty) 119a1235b3eSNicolas Pitre { 120a1235b3eSNicolas Pitre spin_lock_irq(¤t->sighand->siglock); 121a1235b3eSNicolas Pitre __proc_set_tty(tty); 122a1235b3eSNicolas Pitre spin_unlock_irq(¤t->sighand->siglock); 123a1235b3eSNicolas Pitre } 124a1235b3eSNicolas Pitre 125a1235b3eSNicolas Pitre /* 126a1235b3eSNicolas Pitre * Called by tty_open() to set the controlling tty if applicable. 127a1235b3eSNicolas Pitre */ 128a1235b3eSNicolas Pitre void tty_open_proc_set_tty(struct file *filp, struct tty_struct *tty) 129a1235b3eSNicolas Pitre { 130a1235b3eSNicolas Pitre read_lock(&tasklist_lock); 131a1235b3eSNicolas Pitre spin_lock_irq(¤t->sighand->siglock); 132a1235b3eSNicolas Pitre if (current->signal->leader && 133a1235b3eSNicolas Pitre !current->signal->tty && 134a1235b3eSNicolas Pitre tty->session == NULL) { 135a1235b3eSNicolas Pitre /* 136a1235b3eSNicolas Pitre * Don't let a process that only has write access to the tty 137a1235b3eSNicolas Pitre * obtain the privileges associated with having a tty as 138a1235b3eSNicolas Pitre * controlling terminal (being able to reopen it with full 139a1235b3eSNicolas Pitre * access through /dev/tty, being able to perform pushback). 140a1235b3eSNicolas Pitre * Many distributions set the group of all ttys to "tty" and 141a1235b3eSNicolas Pitre * grant write-only access to all terminals for setgid tty 142a1235b3eSNicolas Pitre * binaries, which should not imply full privileges on all ttys. 143a1235b3eSNicolas Pitre * 144a1235b3eSNicolas Pitre * This could theoretically break old code that performs open() 145a1235b3eSNicolas Pitre * on a write-only file descriptor. In that case, it might be 146a1235b3eSNicolas Pitre * necessary to also permit this if 147a1235b3eSNicolas Pitre * inode_permission(inode, MAY_READ) == 0. 148a1235b3eSNicolas Pitre */ 149a1235b3eSNicolas Pitre if (filp->f_mode & FMODE_READ) 150a1235b3eSNicolas Pitre __proc_set_tty(tty); 151a1235b3eSNicolas Pitre } 152a1235b3eSNicolas Pitre spin_unlock_irq(¤t->sighand->siglock); 153a1235b3eSNicolas Pitre read_unlock(&tasklist_lock); 154a1235b3eSNicolas Pitre } 155a1235b3eSNicolas Pitre 156a1235b3eSNicolas Pitre struct tty_struct *get_current_tty(void) 157a1235b3eSNicolas Pitre { 158a1235b3eSNicolas Pitre struct tty_struct *tty; 159a1235b3eSNicolas Pitre unsigned long flags; 160a1235b3eSNicolas Pitre 161a1235b3eSNicolas Pitre spin_lock_irqsave(¤t->sighand->siglock, flags); 162a1235b3eSNicolas Pitre tty = tty_kref_get(current->signal->tty); 163a1235b3eSNicolas Pitre spin_unlock_irqrestore(¤t->sighand->siglock, flags); 164a1235b3eSNicolas Pitre return tty; 165a1235b3eSNicolas Pitre } 166a1235b3eSNicolas Pitre EXPORT_SYMBOL_GPL(get_current_tty); 167a1235b3eSNicolas Pitre 168a1235b3eSNicolas Pitre /* 169a1235b3eSNicolas Pitre * Called from tty_release(). 170a1235b3eSNicolas Pitre */ 171a1235b3eSNicolas Pitre void session_clear_tty(struct pid *session) 172a1235b3eSNicolas Pitre { 173a1235b3eSNicolas Pitre struct task_struct *p; 174a1235b3eSNicolas Pitre do_each_pid_task(session, PIDTYPE_SID, p) { 175a1235b3eSNicolas Pitre proc_clear_tty(p); 176a1235b3eSNicolas Pitre } while_each_pid_task(session, PIDTYPE_SID, p); 177a1235b3eSNicolas Pitre } 178a1235b3eSNicolas Pitre 179a1235b3eSNicolas Pitre /** 180a1235b3eSNicolas Pitre * tty_signal_session_leader - sends SIGHUP to session leader 181a1235b3eSNicolas Pitre * @tty controlling tty 182a1235b3eSNicolas Pitre * @exit_session if non-zero, signal all foreground group processes 183a1235b3eSNicolas Pitre * 184a1235b3eSNicolas Pitre * Send SIGHUP and SIGCONT to the session leader and its process group. 185a1235b3eSNicolas Pitre * Optionally, signal all processes in the foreground process group. 186a1235b3eSNicolas Pitre * 187a1235b3eSNicolas Pitre * Returns the number of processes in the session with this tty 188a1235b3eSNicolas Pitre * as their controlling terminal. This value is used to drop 189a1235b3eSNicolas Pitre * tty references for those processes. 190a1235b3eSNicolas Pitre */ 191a1235b3eSNicolas Pitre int tty_signal_session_leader(struct tty_struct *tty, int exit_session) 192a1235b3eSNicolas Pitre { 193a1235b3eSNicolas Pitre struct task_struct *p; 194a1235b3eSNicolas Pitre int refs = 0; 195a1235b3eSNicolas Pitre struct pid *tty_pgrp = NULL; 196a1235b3eSNicolas Pitre 197a1235b3eSNicolas Pitre read_lock(&tasklist_lock); 198a1235b3eSNicolas Pitre if (tty->session) { 199a1235b3eSNicolas Pitre do_each_pid_task(tty->session, PIDTYPE_SID, p) { 200a1235b3eSNicolas Pitre spin_lock_irq(&p->sighand->siglock); 201a1235b3eSNicolas Pitre if (p->signal->tty == tty) { 202a1235b3eSNicolas Pitre p->signal->tty = NULL; 203a1235b3eSNicolas Pitre /* We defer the dereferences outside fo 204a1235b3eSNicolas Pitre the tasklist lock */ 205a1235b3eSNicolas Pitre refs++; 206a1235b3eSNicolas Pitre } 207a1235b3eSNicolas Pitre if (!p->signal->leader) { 208a1235b3eSNicolas Pitre spin_unlock_irq(&p->sighand->siglock); 209a1235b3eSNicolas Pitre continue; 210a1235b3eSNicolas Pitre } 211a1235b3eSNicolas Pitre __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p); 212a1235b3eSNicolas Pitre __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p); 213a1235b3eSNicolas Pitre put_pid(p->signal->tty_old_pgrp); /* A noop */ 214a1235b3eSNicolas Pitre spin_lock(&tty->ctrl_lock); 215a1235b3eSNicolas Pitre tty_pgrp = get_pid(tty->pgrp); 216a1235b3eSNicolas Pitre if (tty->pgrp) 217a1235b3eSNicolas Pitre p->signal->tty_old_pgrp = get_pid(tty->pgrp); 218a1235b3eSNicolas Pitre spin_unlock(&tty->ctrl_lock); 219a1235b3eSNicolas Pitre spin_unlock_irq(&p->sighand->siglock); 220a1235b3eSNicolas Pitre } while_each_pid_task(tty->session, PIDTYPE_SID, p); 221a1235b3eSNicolas Pitre } 222a1235b3eSNicolas Pitre read_unlock(&tasklist_lock); 223a1235b3eSNicolas Pitre 224a1235b3eSNicolas Pitre if (tty_pgrp) { 225a1235b3eSNicolas Pitre if (exit_session) 226a1235b3eSNicolas Pitre kill_pgrp(tty_pgrp, SIGHUP, exit_session); 227a1235b3eSNicolas Pitre put_pid(tty_pgrp); 228a1235b3eSNicolas Pitre } 229a1235b3eSNicolas Pitre 230a1235b3eSNicolas Pitre return refs; 231a1235b3eSNicolas Pitre } 232a1235b3eSNicolas Pitre 233a1235b3eSNicolas Pitre /** 234a1235b3eSNicolas Pitre * disassociate_ctty - disconnect controlling tty 235a1235b3eSNicolas Pitre * @on_exit: true if exiting so need to "hang up" the session 236a1235b3eSNicolas Pitre * 237a1235b3eSNicolas Pitre * This function is typically called only by the session leader, when 238a1235b3eSNicolas Pitre * it wants to disassociate itself from its controlling tty. 239a1235b3eSNicolas Pitre * 240a1235b3eSNicolas Pitre * It performs the following functions: 241a1235b3eSNicolas Pitre * (1) Sends a SIGHUP and SIGCONT to the foreground process group 242a1235b3eSNicolas Pitre * (2) Clears the tty from being controlling the session 243a1235b3eSNicolas Pitre * (3) Clears the controlling tty for all processes in the 244a1235b3eSNicolas Pitre * session group. 245a1235b3eSNicolas Pitre * 246a1235b3eSNicolas Pitre * The argument on_exit is set to 1 if called when a process is 247a1235b3eSNicolas Pitre * exiting; it is 0 if called by the ioctl TIOCNOTTY. 248a1235b3eSNicolas Pitre * 249a1235b3eSNicolas Pitre * Locking: 250a1235b3eSNicolas Pitre * BTM is taken for hysterical raisons, and held when 251a1235b3eSNicolas Pitre * called from no_tty(). 252a1235b3eSNicolas Pitre * tty_mutex is taken to protect tty 253a1235b3eSNicolas Pitre * ->siglock is taken to protect ->signal/->sighand 254a1235b3eSNicolas Pitre * tasklist_lock is taken to walk process list for sessions 255a1235b3eSNicolas Pitre * ->siglock is taken to protect ->signal/->sighand 256a1235b3eSNicolas Pitre */ 257a1235b3eSNicolas Pitre void disassociate_ctty(int on_exit) 258a1235b3eSNicolas Pitre { 259a1235b3eSNicolas Pitre struct tty_struct *tty; 260a1235b3eSNicolas Pitre 261a1235b3eSNicolas Pitre if (!current->signal->leader) 262a1235b3eSNicolas Pitre return; 263a1235b3eSNicolas Pitre 264a1235b3eSNicolas Pitre tty = get_current_tty(); 265a1235b3eSNicolas Pitre if (tty) { 266a1235b3eSNicolas Pitre if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY) { 267a1235b3eSNicolas Pitre tty_vhangup_session(tty); 268a1235b3eSNicolas Pitre } else { 269a1235b3eSNicolas Pitre struct pid *tty_pgrp = tty_get_pgrp(tty); 270a1235b3eSNicolas Pitre if (tty_pgrp) { 271a1235b3eSNicolas Pitre kill_pgrp(tty_pgrp, SIGHUP, on_exit); 272a1235b3eSNicolas Pitre if (!on_exit) 273a1235b3eSNicolas Pitre kill_pgrp(tty_pgrp, SIGCONT, on_exit); 274a1235b3eSNicolas Pitre put_pid(tty_pgrp); 275a1235b3eSNicolas Pitre } 276a1235b3eSNicolas Pitre } 277a1235b3eSNicolas Pitre tty_kref_put(tty); 278a1235b3eSNicolas Pitre 279a1235b3eSNicolas Pitre } else if (on_exit) { 280a1235b3eSNicolas Pitre struct pid *old_pgrp; 281a1235b3eSNicolas Pitre spin_lock_irq(¤t->sighand->siglock); 282a1235b3eSNicolas Pitre old_pgrp = current->signal->tty_old_pgrp; 283a1235b3eSNicolas Pitre current->signal->tty_old_pgrp = NULL; 284a1235b3eSNicolas Pitre spin_unlock_irq(¤t->sighand->siglock); 285a1235b3eSNicolas Pitre if (old_pgrp) { 286a1235b3eSNicolas Pitre kill_pgrp(old_pgrp, SIGHUP, on_exit); 287a1235b3eSNicolas Pitre kill_pgrp(old_pgrp, SIGCONT, on_exit); 288a1235b3eSNicolas Pitre put_pid(old_pgrp); 289a1235b3eSNicolas Pitre } 290a1235b3eSNicolas Pitre return; 291a1235b3eSNicolas Pitre } 292a1235b3eSNicolas Pitre 293a1235b3eSNicolas Pitre spin_lock_irq(¤t->sighand->siglock); 294a1235b3eSNicolas Pitre put_pid(current->signal->tty_old_pgrp); 295a1235b3eSNicolas Pitre current->signal->tty_old_pgrp = NULL; 296a1235b3eSNicolas Pitre 297a1235b3eSNicolas Pitre tty = tty_kref_get(current->signal->tty); 298a1235b3eSNicolas Pitre if (tty) { 299a1235b3eSNicolas Pitre unsigned long flags; 300a1235b3eSNicolas Pitre spin_lock_irqsave(&tty->ctrl_lock, flags); 301a1235b3eSNicolas Pitre put_pid(tty->session); 302a1235b3eSNicolas Pitre put_pid(tty->pgrp); 303a1235b3eSNicolas Pitre tty->session = NULL; 304a1235b3eSNicolas Pitre tty->pgrp = NULL; 305a1235b3eSNicolas Pitre spin_unlock_irqrestore(&tty->ctrl_lock, flags); 306a1235b3eSNicolas Pitre tty_kref_put(tty); 307a1235b3eSNicolas Pitre } 308a1235b3eSNicolas Pitre 309a1235b3eSNicolas Pitre spin_unlock_irq(¤t->sighand->siglock); 310a1235b3eSNicolas Pitre /* Now clear signal->tty under the lock */ 311a1235b3eSNicolas Pitre read_lock(&tasklist_lock); 312a1235b3eSNicolas Pitre session_clear_tty(task_session(current)); 313a1235b3eSNicolas Pitre read_unlock(&tasklist_lock); 314a1235b3eSNicolas Pitre } 315a1235b3eSNicolas Pitre 316a1235b3eSNicolas Pitre /** 317a1235b3eSNicolas Pitre * 318a1235b3eSNicolas Pitre * no_tty - Ensure the current process does not have a controlling tty 319a1235b3eSNicolas Pitre */ 320a1235b3eSNicolas Pitre void no_tty(void) 321a1235b3eSNicolas Pitre { 322a1235b3eSNicolas Pitre /* FIXME: Review locking here. The tty_lock never covered any race 323a1235b3eSNicolas Pitre between a new association and proc_clear_tty but possible we need 324a1235b3eSNicolas Pitre to protect against this anyway */ 325a1235b3eSNicolas Pitre struct task_struct *tsk = current; 326a1235b3eSNicolas Pitre disassociate_ctty(0); 327a1235b3eSNicolas Pitre proc_clear_tty(tsk); 328a1235b3eSNicolas Pitre } 329a1235b3eSNicolas Pitre 330a1235b3eSNicolas Pitre /** 331a1235b3eSNicolas Pitre * tiocsctty - set controlling tty 332a1235b3eSNicolas Pitre * @tty: tty structure 333a1235b3eSNicolas Pitre * @arg: user argument 334a1235b3eSNicolas Pitre * 335a1235b3eSNicolas Pitre * This ioctl is used to manage job control. It permits a session 336a1235b3eSNicolas Pitre * leader to set this tty as the controlling tty for the session. 337a1235b3eSNicolas Pitre * 338a1235b3eSNicolas Pitre * Locking: 339a1235b3eSNicolas Pitre * Takes tty_lock() to serialize proc_set_tty() for this tty 340a1235b3eSNicolas Pitre * Takes tasklist_lock internally to walk sessions 341a1235b3eSNicolas Pitre * Takes ->siglock() when updating signal->tty 342a1235b3eSNicolas Pitre */ 343a1235b3eSNicolas Pitre static int tiocsctty(struct tty_struct *tty, struct file *file, int arg) 344a1235b3eSNicolas Pitre { 345a1235b3eSNicolas Pitre int ret = 0; 346a1235b3eSNicolas Pitre 347a1235b3eSNicolas Pitre tty_lock(tty); 348a1235b3eSNicolas Pitre read_lock(&tasklist_lock); 349a1235b3eSNicolas Pitre 350a1235b3eSNicolas Pitre if (current->signal->leader && (task_session(current) == tty->session)) 351a1235b3eSNicolas Pitre goto unlock; 352a1235b3eSNicolas Pitre 353a1235b3eSNicolas Pitre /* 354a1235b3eSNicolas Pitre * The process must be a session leader and 355a1235b3eSNicolas Pitre * not have a controlling tty already. 356a1235b3eSNicolas Pitre */ 357a1235b3eSNicolas Pitre if (!current->signal->leader || current->signal->tty) { 358a1235b3eSNicolas Pitre ret = -EPERM; 359a1235b3eSNicolas Pitre goto unlock; 360a1235b3eSNicolas Pitre } 361a1235b3eSNicolas Pitre 362a1235b3eSNicolas Pitre if (tty->session) { 363a1235b3eSNicolas Pitre /* 364a1235b3eSNicolas Pitre * This tty is already the controlling 365a1235b3eSNicolas Pitre * tty for another session group! 366a1235b3eSNicolas Pitre */ 367a1235b3eSNicolas Pitre if (arg == 1 && capable(CAP_SYS_ADMIN)) { 368a1235b3eSNicolas Pitre /* 369a1235b3eSNicolas Pitre * Steal it away 370a1235b3eSNicolas Pitre */ 371a1235b3eSNicolas Pitre session_clear_tty(tty->session); 372a1235b3eSNicolas Pitre } else { 373a1235b3eSNicolas Pitre ret = -EPERM; 374a1235b3eSNicolas Pitre goto unlock; 375a1235b3eSNicolas Pitre } 376a1235b3eSNicolas Pitre } 377a1235b3eSNicolas Pitre 378a1235b3eSNicolas Pitre /* See the comment in tty_open_proc_set_tty(). */ 379a1235b3eSNicolas Pitre if ((file->f_mode & FMODE_READ) == 0 && !capable(CAP_SYS_ADMIN)) { 380a1235b3eSNicolas Pitre ret = -EPERM; 381a1235b3eSNicolas Pitre goto unlock; 382a1235b3eSNicolas Pitre } 383a1235b3eSNicolas Pitre 384a1235b3eSNicolas Pitre proc_set_tty(tty); 385a1235b3eSNicolas Pitre unlock: 386a1235b3eSNicolas Pitre read_unlock(&tasklist_lock); 387a1235b3eSNicolas Pitre tty_unlock(tty); 388a1235b3eSNicolas Pitre return ret; 389a1235b3eSNicolas Pitre } 390a1235b3eSNicolas Pitre 391a1235b3eSNicolas Pitre /** 392a1235b3eSNicolas Pitre * tty_get_pgrp - return a ref counted pgrp pid 393a1235b3eSNicolas Pitre * @tty: tty to read 394a1235b3eSNicolas Pitre * 395a1235b3eSNicolas Pitre * Returns a refcounted instance of the pid struct for the process 396a1235b3eSNicolas Pitre * group controlling the tty. 397a1235b3eSNicolas Pitre */ 398a1235b3eSNicolas Pitre struct pid *tty_get_pgrp(struct tty_struct *tty) 399a1235b3eSNicolas Pitre { 400a1235b3eSNicolas Pitre unsigned long flags; 401a1235b3eSNicolas Pitre struct pid *pgrp; 402a1235b3eSNicolas Pitre 403a1235b3eSNicolas Pitre spin_lock_irqsave(&tty->ctrl_lock, flags); 404a1235b3eSNicolas Pitre pgrp = get_pid(tty->pgrp); 405a1235b3eSNicolas Pitre spin_unlock_irqrestore(&tty->ctrl_lock, flags); 406a1235b3eSNicolas Pitre 407a1235b3eSNicolas Pitre return pgrp; 408a1235b3eSNicolas Pitre } 409a1235b3eSNicolas Pitre EXPORT_SYMBOL_GPL(tty_get_pgrp); 410a1235b3eSNicolas Pitre 411a1235b3eSNicolas Pitre /* 412a1235b3eSNicolas Pitre * This checks not only the pgrp, but falls back on the pid if no 413a1235b3eSNicolas Pitre * satisfactory pgrp is found. I dunno - gdb doesn't work correctly 414a1235b3eSNicolas Pitre * without this... 415a1235b3eSNicolas Pitre * 416a1235b3eSNicolas Pitre * The caller must hold rcu lock or the tasklist lock. 417a1235b3eSNicolas Pitre */ 418a1235b3eSNicolas Pitre static struct pid *session_of_pgrp(struct pid *pgrp) 419a1235b3eSNicolas Pitre { 420a1235b3eSNicolas Pitre struct task_struct *p; 421a1235b3eSNicolas Pitre struct pid *sid = NULL; 422a1235b3eSNicolas Pitre 423a1235b3eSNicolas Pitre p = pid_task(pgrp, PIDTYPE_PGID); 424a1235b3eSNicolas Pitre if (p == NULL) 425a1235b3eSNicolas Pitre p = pid_task(pgrp, PIDTYPE_PID); 426a1235b3eSNicolas Pitre if (p != NULL) 427a1235b3eSNicolas Pitre sid = task_session(p); 428a1235b3eSNicolas Pitre 429a1235b3eSNicolas Pitre return sid; 430a1235b3eSNicolas Pitre } 431a1235b3eSNicolas Pitre 432a1235b3eSNicolas Pitre /** 433a1235b3eSNicolas Pitre * tiocgpgrp - get process group 434a1235b3eSNicolas Pitre * @tty: tty passed by user 435a1235b3eSNicolas Pitre * @real_tty: tty side of the tty passed by the user if a pty else the tty 436a1235b3eSNicolas Pitre * @p: returned pid 437a1235b3eSNicolas Pitre * 438a1235b3eSNicolas Pitre * Obtain the process group of the tty. If there is no process group 439a1235b3eSNicolas Pitre * return an error. 440a1235b3eSNicolas Pitre * 441a1235b3eSNicolas Pitre * Locking: none. Reference to current->signal->tty is safe. 442a1235b3eSNicolas Pitre */ 443a1235b3eSNicolas Pitre static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p) 444a1235b3eSNicolas Pitre { 445a1235b3eSNicolas Pitre struct pid *pid; 446a1235b3eSNicolas Pitre int ret; 447a1235b3eSNicolas Pitre /* 448a1235b3eSNicolas Pitre * (tty == real_tty) is a cheap way of 449a1235b3eSNicolas Pitre * testing if the tty is NOT a master pty. 450a1235b3eSNicolas Pitre */ 451a1235b3eSNicolas Pitre if (tty == real_tty && current->signal->tty != real_tty) 452a1235b3eSNicolas Pitre return -ENOTTY; 453a1235b3eSNicolas Pitre pid = tty_get_pgrp(real_tty); 454a1235b3eSNicolas Pitre ret = put_user(pid_vnr(pid), p); 455a1235b3eSNicolas Pitre put_pid(pid); 456a1235b3eSNicolas Pitre return ret; 457a1235b3eSNicolas Pitre } 458a1235b3eSNicolas Pitre 459a1235b3eSNicolas Pitre /** 460a1235b3eSNicolas Pitre * tiocspgrp - attempt to set process group 461a1235b3eSNicolas Pitre * @tty: tty passed by user 462a1235b3eSNicolas Pitre * @real_tty: tty side device matching tty passed by user 463a1235b3eSNicolas Pitre * @p: pid pointer 464a1235b3eSNicolas Pitre * 465a1235b3eSNicolas Pitre * Set the process group of the tty to the session passed. Only 466a1235b3eSNicolas Pitre * permitted where the tty session is our session. 467a1235b3eSNicolas Pitre * 468a1235b3eSNicolas Pitre * Locking: RCU, ctrl lock 469a1235b3eSNicolas Pitre */ 470a1235b3eSNicolas Pitre static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p) 471a1235b3eSNicolas Pitre { 472a1235b3eSNicolas Pitre struct pid *pgrp; 473a1235b3eSNicolas Pitre pid_t pgrp_nr; 474a1235b3eSNicolas Pitre int retval = tty_check_change(real_tty); 475a1235b3eSNicolas Pitre 476a1235b3eSNicolas Pitre if (retval == -EIO) 477a1235b3eSNicolas Pitre return -ENOTTY; 478a1235b3eSNicolas Pitre if (retval) 479a1235b3eSNicolas Pitre return retval; 480a1235b3eSNicolas Pitre if (!current->signal->tty || 481a1235b3eSNicolas Pitre (current->signal->tty != real_tty) || 482a1235b3eSNicolas Pitre (real_tty->session != task_session(current))) 483a1235b3eSNicolas Pitre return -ENOTTY; 484a1235b3eSNicolas Pitre if (get_user(pgrp_nr, p)) 485a1235b3eSNicolas Pitre return -EFAULT; 486a1235b3eSNicolas Pitre if (pgrp_nr < 0) 487a1235b3eSNicolas Pitre return -EINVAL; 488a1235b3eSNicolas Pitre rcu_read_lock(); 489a1235b3eSNicolas Pitre pgrp = find_vpid(pgrp_nr); 490a1235b3eSNicolas Pitre retval = -ESRCH; 491a1235b3eSNicolas Pitre if (!pgrp) 492a1235b3eSNicolas Pitre goto out_unlock; 493a1235b3eSNicolas Pitre retval = -EPERM; 494a1235b3eSNicolas Pitre if (session_of_pgrp(pgrp) != task_session(current)) 495a1235b3eSNicolas Pitre goto out_unlock; 496a1235b3eSNicolas Pitre retval = 0; 497a1235b3eSNicolas Pitre spin_lock_irq(&tty->ctrl_lock); 498a1235b3eSNicolas Pitre put_pid(real_tty->pgrp); 499a1235b3eSNicolas Pitre real_tty->pgrp = get_pid(pgrp); 500a1235b3eSNicolas Pitre spin_unlock_irq(&tty->ctrl_lock); 501a1235b3eSNicolas Pitre out_unlock: 502a1235b3eSNicolas Pitre rcu_read_unlock(); 503a1235b3eSNicolas Pitre return retval; 504a1235b3eSNicolas Pitre } 505a1235b3eSNicolas Pitre 506a1235b3eSNicolas Pitre /** 507a1235b3eSNicolas Pitre * tiocgsid - get session id 508a1235b3eSNicolas Pitre * @tty: tty passed by user 509a1235b3eSNicolas Pitre * @real_tty: tty side of the tty passed by the user if a pty else the tty 510a1235b3eSNicolas Pitre * @p: pointer to returned session id 511a1235b3eSNicolas Pitre * 512a1235b3eSNicolas Pitre * Obtain the session id of the tty. If there is no session 513a1235b3eSNicolas Pitre * return an error. 514a1235b3eSNicolas Pitre * 515a1235b3eSNicolas Pitre * Locking: none. Reference to current->signal->tty is safe. 516a1235b3eSNicolas Pitre */ 517a1235b3eSNicolas Pitre static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p) 518a1235b3eSNicolas Pitre { 519a1235b3eSNicolas Pitre /* 520a1235b3eSNicolas Pitre * (tty == real_tty) is a cheap way of 521a1235b3eSNicolas Pitre * testing if the tty is NOT a master pty. 522a1235b3eSNicolas Pitre */ 523a1235b3eSNicolas Pitre if (tty == real_tty && current->signal->tty != real_tty) 524a1235b3eSNicolas Pitre return -ENOTTY; 525a1235b3eSNicolas Pitre if (!real_tty->session) 526a1235b3eSNicolas Pitre return -ENOTTY; 527a1235b3eSNicolas Pitre return put_user(pid_vnr(real_tty->session), p); 528a1235b3eSNicolas Pitre } 529a1235b3eSNicolas Pitre 530a1235b3eSNicolas Pitre /* 531a1235b3eSNicolas Pitre * Called from tty_ioctl(). If tty is a pty then real_tty is the slave side, 532a1235b3eSNicolas Pitre * if not then tty == real_tty. 533a1235b3eSNicolas Pitre */ 534a1235b3eSNicolas Pitre long tty_jobctrl_ioctl(struct tty_struct *tty, struct tty_struct *real_tty, 535a1235b3eSNicolas Pitre struct file *file, unsigned int cmd, unsigned long arg) 536a1235b3eSNicolas Pitre { 537a1235b3eSNicolas Pitre void __user *p = (void __user *)arg; 538a1235b3eSNicolas Pitre 539a1235b3eSNicolas Pitre switch (cmd) { 540a1235b3eSNicolas Pitre case TIOCNOTTY: 541a1235b3eSNicolas Pitre if (current->signal->tty != tty) 542a1235b3eSNicolas Pitre return -ENOTTY; 543a1235b3eSNicolas Pitre no_tty(); 544a1235b3eSNicolas Pitre return 0; 545a1235b3eSNicolas Pitre case TIOCSCTTY: 546a1235b3eSNicolas Pitre return tiocsctty(real_tty, file, arg); 547a1235b3eSNicolas Pitre case TIOCGPGRP: 548a1235b3eSNicolas Pitre return tiocgpgrp(tty, real_tty, p); 549a1235b3eSNicolas Pitre case TIOCSPGRP: 550a1235b3eSNicolas Pitre return tiocspgrp(tty, real_tty, p); 551a1235b3eSNicolas Pitre case TIOCGSID: 552a1235b3eSNicolas Pitre return tiocgsid(tty, real_tty, p); 553a1235b3eSNicolas Pitre } 554a1235b3eSNicolas Pitre return -ENOIOCTLCMD; 555a1235b3eSNicolas Pitre } 556