1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* Task credentials management - see Documentation/security/credentials.rst 3 * 4 * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved. 5 * Written by David Howells (dhowells@redhat.com) 6 */ 7 8 #define pr_fmt(fmt) "CRED: " fmt 9 10 #include <linux/export.h> 11 #include <linux/cred.h> 12 #include <linux/slab.h> 13 #include <linux/sched.h> 14 #include <linux/sched/coredump.h> 15 #include <linux/key.h> 16 #include <linux/keyctl.h> 17 #include <linux/init_task.h> 18 #include <linux/security.h> 19 #include <linux/binfmts.h> 20 #include <linux/cn_proc.h> 21 #include <linux/uidgid.h> 22 23 #if 0 24 #define kdebug(FMT, ...) \ 25 printk("[%-5.5s%5u] " FMT "\n", \ 26 current->comm, current->pid, ##__VA_ARGS__) 27 #else 28 #define kdebug(FMT, ...) \ 29 do { \ 30 if (0) \ 31 no_printk("[%-5.5s%5u] " FMT "\n", \ 32 current->comm, current->pid, ##__VA_ARGS__); \ 33 } while (0) 34 #endif 35 36 static struct kmem_cache *cred_jar; 37 38 /* init to 2 - one for init_task, one to ensure it is never freed */ 39 static struct group_info init_groups = { .usage = ATOMIC_INIT(2) }; 40 41 /* 42 * The initial credentials for the initial task 43 */ 44 struct cred init_cred = { 45 .usage = ATOMIC_INIT(4), 46 #ifdef CONFIG_DEBUG_CREDENTIALS 47 .subscribers = ATOMIC_INIT(2), 48 .magic = CRED_MAGIC, 49 #endif 50 .uid = GLOBAL_ROOT_UID, 51 .gid = GLOBAL_ROOT_GID, 52 .suid = GLOBAL_ROOT_UID, 53 .sgid = GLOBAL_ROOT_GID, 54 .euid = GLOBAL_ROOT_UID, 55 .egid = GLOBAL_ROOT_GID, 56 .fsuid = GLOBAL_ROOT_UID, 57 .fsgid = GLOBAL_ROOT_GID, 58 .securebits = SECUREBITS_DEFAULT, 59 .cap_inheritable = CAP_EMPTY_SET, 60 .cap_permitted = CAP_FULL_SET, 61 .cap_effective = CAP_FULL_SET, 62 .cap_bset = CAP_FULL_SET, 63 .user = INIT_USER, 64 .user_ns = &init_user_ns, 65 .group_info = &init_groups, 66 .ucounts = &init_ucounts, 67 }; 68 69 static inline void set_cred_subscribers(struct cred *cred, int n) 70 { 71 #ifdef CONFIG_DEBUG_CREDENTIALS 72 atomic_set(&cred->subscribers, n); 73 #endif 74 } 75 76 static inline int read_cred_subscribers(const struct cred *cred) 77 { 78 #ifdef CONFIG_DEBUG_CREDENTIALS 79 return atomic_read(&cred->subscribers); 80 #else 81 return 0; 82 #endif 83 } 84 85 static inline void alter_cred_subscribers(const struct cred *_cred, int n) 86 { 87 #ifdef CONFIG_DEBUG_CREDENTIALS 88 struct cred *cred = (struct cred *) _cred; 89 90 atomic_add(n, &cred->subscribers); 91 #endif 92 } 93 94 /* 95 * The RCU callback to actually dispose of a set of credentials 96 */ 97 static void put_cred_rcu(struct rcu_head *rcu) 98 { 99 struct cred *cred = container_of(rcu, struct cred, rcu); 100 101 kdebug("put_cred_rcu(%p)", cred); 102 103 #ifdef CONFIG_DEBUG_CREDENTIALS 104 if (cred->magic != CRED_MAGIC_DEAD || 105 atomic_read(&cred->usage) != 0 || 106 read_cred_subscribers(cred) != 0) 107 panic("CRED: put_cred_rcu() sees %p with" 108 " mag %x, put %p, usage %d, subscr %d\n", 109 cred, cred->magic, cred->put_addr, 110 atomic_read(&cred->usage), 111 read_cred_subscribers(cred)); 112 #else 113 if (atomic_read(&cred->usage) != 0) 114 panic("CRED: put_cred_rcu() sees %p with usage %d\n", 115 cred, atomic_read(&cred->usage)); 116 #endif 117 118 security_cred_free(cred); 119 key_put(cred->session_keyring); 120 key_put(cred->process_keyring); 121 key_put(cred->thread_keyring); 122 key_put(cred->request_key_auth); 123 if (cred->group_info) 124 put_group_info(cred->group_info); 125 free_uid(cred->user); 126 if (cred->ucounts) 127 put_ucounts(cred->ucounts); 128 put_user_ns(cred->user_ns); 129 kmem_cache_free(cred_jar, cred); 130 } 131 132 /** 133 * __put_cred - Destroy a set of credentials 134 * @cred: The record to release 135 * 136 * Destroy a set of credentials on which no references remain. 137 */ 138 void __put_cred(struct cred *cred) 139 { 140 kdebug("__put_cred(%p{%d,%d})", cred, 141 atomic_read(&cred->usage), 142 read_cred_subscribers(cred)); 143 144 BUG_ON(atomic_read(&cred->usage) != 0); 145 #ifdef CONFIG_DEBUG_CREDENTIALS 146 BUG_ON(read_cred_subscribers(cred) != 0); 147 cred->magic = CRED_MAGIC_DEAD; 148 cred->put_addr = __builtin_return_address(0); 149 #endif 150 BUG_ON(cred == current->cred); 151 BUG_ON(cred == current->real_cred); 152 153 if (cred->non_rcu) 154 put_cred_rcu(&cred->rcu); 155 else 156 call_rcu(&cred->rcu, put_cred_rcu); 157 } 158 EXPORT_SYMBOL(__put_cred); 159 160 /* 161 * Clean up a task's credentials when it exits 162 */ 163 void exit_creds(struct task_struct *tsk) 164 { 165 struct cred *cred; 166 167 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred, 168 atomic_read(&tsk->cred->usage), 169 read_cred_subscribers(tsk->cred)); 170 171 cred = (struct cred *) tsk->real_cred; 172 tsk->real_cred = NULL; 173 validate_creds(cred); 174 alter_cred_subscribers(cred, -1); 175 put_cred(cred); 176 177 cred = (struct cred *) tsk->cred; 178 tsk->cred = NULL; 179 validate_creds(cred); 180 alter_cred_subscribers(cred, -1); 181 put_cred(cred); 182 183 #ifdef CONFIG_KEYS_REQUEST_CACHE 184 key_put(tsk->cached_requested_key); 185 tsk->cached_requested_key = NULL; 186 #endif 187 } 188 189 /** 190 * get_task_cred - Get another task's objective credentials 191 * @task: The task to query 192 * 193 * Get the objective credentials of a task, pinning them so that they can't go 194 * away. Accessing a task's credentials directly is not permitted. 195 * 196 * The caller must also make sure task doesn't get deleted, either by holding a 197 * ref on task or by holding tasklist_lock to prevent it from being unlinked. 198 */ 199 const struct cred *get_task_cred(struct task_struct *task) 200 { 201 const struct cred *cred; 202 203 rcu_read_lock(); 204 205 do { 206 cred = __task_cred((task)); 207 BUG_ON(!cred); 208 } while (!get_cred_rcu(cred)); 209 210 rcu_read_unlock(); 211 return cred; 212 } 213 EXPORT_SYMBOL(get_task_cred); 214 215 /* 216 * Allocate blank credentials, such that the credentials can be filled in at a 217 * later date without risk of ENOMEM. 218 */ 219 struct cred *cred_alloc_blank(void) 220 { 221 struct cred *new; 222 223 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL); 224 if (!new) 225 return NULL; 226 227 atomic_set(&new->usage, 1); 228 #ifdef CONFIG_DEBUG_CREDENTIALS 229 new->magic = CRED_MAGIC; 230 #endif 231 if (security_cred_alloc_blank(new, GFP_KERNEL_ACCOUNT) < 0) 232 goto error; 233 234 return new; 235 236 error: 237 abort_creds(new); 238 return NULL; 239 } 240 241 /** 242 * prepare_creds - Prepare a new set of credentials for modification 243 * 244 * Prepare a new set of task credentials for modification. A task's creds 245 * shouldn't generally be modified directly, therefore this function is used to 246 * prepare a new copy, which the caller then modifies and then commits by 247 * calling commit_creds(). 248 * 249 * Preparation involves making a copy of the objective creds for modification. 250 * 251 * Returns a pointer to the new creds-to-be if successful, NULL otherwise. 252 * 253 * Call commit_creds() or abort_creds() to clean up. 254 */ 255 struct cred *prepare_creds(void) 256 { 257 struct task_struct *task = current; 258 const struct cred *old; 259 struct cred *new; 260 261 validate_process_creds(); 262 263 new = kmem_cache_alloc(cred_jar, GFP_KERNEL); 264 if (!new) 265 return NULL; 266 267 kdebug("prepare_creds() alloc %p", new); 268 269 old = task->cred; 270 memcpy(new, old, sizeof(struct cred)); 271 272 new->non_rcu = 0; 273 atomic_set(&new->usage, 1); 274 set_cred_subscribers(new, 0); 275 get_group_info(new->group_info); 276 get_uid(new->user); 277 get_user_ns(new->user_ns); 278 279 #ifdef CONFIG_KEYS 280 key_get(new->session_keyring); 281 key_get(new->process_keyring); 282 key_get(new->thread_keyring); 283 key_get(new->request_key_auth); 284 #endif 285 286 #ifdef CONFIG_SECURITY 287 new->security = NULL; 288 #endif 289 290 new->ucounts = get_ucounts(new->ucounts); 291 if (!new->ucounts) 292 goto error; 293 294 if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0) 295 goto error; 296 297 validate_creds(new); 298 return new; 299 300 error: 301 abort_creds(new); 302 return NULL; 303 } 304 EXPORT_SYMBOL(prepare_creds); 305 306 /* 307 * Prepare credentials for current to perform an execve() 308 * - The caller must hold ->cred_guard_mutex 309 */ 310 struct cred *prepare_exec_creds(void) 311 { 312 struct cred *new; 313 314 new = prepare_creds(); 315 if (!new) 316 return new; 317 318 #ifdef CONFIG_KEYS 319 /* newly exec'd tasks don't get a thread keyring */ 320 key_put(new->thread_keyring); 321 new->thread_keyring = NULL; 322 323 /* inherit the session keyring; new process keyring */ 324 key_put(new->process_keyring); 325 new->process_keyring = NULL; 326 #endif 327 328 new->suid = new->fsuid = new->euid; 329 new->sgid = new->fsgid = new->egid; 330 331 return new; 332 } 333 334 /* 335 * Copy credentials for the new process created by fork() 336 * 337 * We share if we can, but under some circumstances we have to generate a new 338 * set. 339 * 340 * The new process gets the current process's subjective credentials as its 341 * objective and subjective credentials 342 */ 343 int copy_creds(struct task_struct *p, unsigned long clone_flags) 344 { 345 struct cred *new; 346 int ret; 347 348 #ifdef CONFIG_KEYS_REQUEST_CACHE 349 p->cached_requested_key = NULL; 350 #endif 351 352 if ( 353 #ifdef CONFIG_KEYS 354 !p->cred->thread_keyring && 355 #endif 356 clone_flags & CLONE_THREAD 357 ) { 358 p->real_cred = get_cred(p->cred); 359 get_cred(p->cred); 360 alter_cred_subscribers(p->cred, 2); 361 kdebug("share_creds(%p{%d,%d})", 362 p->cred, atomic_read(&p->cred->usage), 363 read_cred_subscribers(p->cred)); 364 inc_rlimit_ucounts(task_ucounts(p), UCOUNT_RLIMIT_NPROC, 1); 365 return 0; 366 } 367 368 new = prepare_creds(); 369 if (!new) 370 return -ENOMEM; 371 372 if (clone_flags & CLONE_NEWUSER) { 373 ret = create_user_ns(new); 374 if (ret < 0) 375 goto error_put; 376 ret = set_cred_ucounts(new); 377 if (ret < 0) 378 goto error_put; 379 } 380 381 #ifdef CONFIG_KEYS 382 /* new threads get their own thread keyrings if their parent already 383 * had one */ 384 if (new->thread_keyring) { 385 key_put(new->thread_keyring); 386 new->thread_keyring = NULL; 387 if (clone_flags & CLONE_THREAD) 388 install_thread_keyring_to_cred(new); 389 } 390 391 /* The process keyring is only shared between the threads in a process; 392 * anything outside of those threads doesn't inherit. 393 */ 394 if (!(clone_flags & CLONE_THREAD)) { 395 key_put(new->process_keyring); 396 new->process_keyring = NULL; 397 } 398 #endif 399 400 p->cred = p->real_cred = get_cred(new); 401 inc_rlimit_ucounts(task_ucounts(p), UCOUNT_RLIMIT_NPROC, 1); 402 alter_cred_subscribers(new, 2); 403 validate_creds(new); 404 return 0; 405 406 error_put: 407 put_cred(new); 408 return ret; 409 } 410 411 static bool cred_cap_issubset(const struct cred *set, const struct cred *subset) 412 { 413 const struct user_namespace *set_ns = set->user_ns; 414 const struct user_namespace *subset_ns = subset->user_ns; 415 416 /* If the two credentials are in the same user namespace see if 417 * the capabilities of subset are a subset of set. 418 */ 419 if (set_ns == subset_ns) 420 return cap_issubset(subset->cap_permitted, set->cap_permitted); 421 422 /* The credentials are in a different user namespaces 423 * therefore one is a subset of the other only if a set is an 424 * ancestor of subset and set->euid is owner of subset or one 425 * of subsets ancestors. 426 */ 427 for (;subset_ns != &init_user_ns; subset_ns = subset_ns->parent) { 428 if ((set_ns == subset_ns->parent) && 429 uid_eq(subset_ns->owner, set->euid)) 430 return true; 431 } 432 433 return false; 434 } 435 436 /** 437 * commit_creds - Install new credentials upon the current task 438 * @new: The credentials to be assigned 439 * 440 * Install a new set of credentials to the current task, using RCU to replace 441 * the old set. Both the objective and the subjective credentials pointers are 442 * updated. This function may not be called if the subjective credentials are 443 * in an overridden state. 444 * 445 * This function eats the caller's reference to the new credentials. 446 * 447 * Always returns 0 thus allowing this function to be tail-called at the end 448 * of, say, sys_setgid(). 449 */ 450 int commit_creds(struct cred *new) 451 { 452 struct task_struct *task = current; 453 const struct cred *old = task->real_cred; 454 455 kdebug("commit_creds(%p{%d,%d})", new, 456 atomic_read(&new->usage), 457 read_cred_subscribers(new)); 458 459 BUG_ON(task->cred != old); 460 #ifdef CONFIG_DEBUG_CREDENTIALS 461 BUG_ON(read_cred_subscribers(old) < 2); 462 validate_creds(old); 463 validate_creds(new); 464 #endif 465 BUG_ON(atomic_read(&new->usage) < 1); 466 467 get_cred(new); /* we will require a ref for the subj creds too */ 468 469 /* dumpability changes */ 470 if (!uid_eq(old->euid, new->euid) || 471 !gid_eq(old->egid, new->egid) || 472 !uid_eq(old->fsuid, new->fsuid) || 473 !gid_eq(old->fsgid, new->fsgid) || 474 !cred_cap_issubset(old, new)) { 475 if (task->mm) 476 set_dumpable(task->mm, suid_dumpable); 477 task->pdeath_signal = 0; 478 /* 479 * If a task drops privileges and becomes nondumpable, 480 * the dumpability change must become visible before 481 * the credential change; otherwise, a __ptrace_may_access() 482 * racing with this change may be able to attach to a task it 483 * shouldn't be able to attach to (as if the task had dropped 484 * privileges without becoming nondumpable). 485 * Pairs with a read barrier in __ptrace_may_access(). 486 */ 487 smp_wmb(); 488 } 489 490 /* alter the thread keyring */ 491 if (!uid_eq(new->fsuid, old->fsuid)) 492 key_fsuid_changed(new); 493 if (!gid_eq(new->fsgid, old->fsgid)) 494 key_fsgid_changed(new); 495 496 /* do it 497 * RLIMIT_NPROC limits on user->processes have already been checked 498 * in set_user(). 499 */ 500 alter_cred_subscribers(new, 2); 501 if (new->user != old->user || new->user_ns != old->user_ns) 502 inc_rlimit_ucounts(new->ucounts, UCOUNT_RLIMIT_NPROC, 1); 503 rcu_assign_pointer(task->real_cred, new); 504 rcu_assign_pointer(task->cred, new); 505 if (new->user != old->user || new->user_ns != old->user_ns) 506 dec_rlimit_ucounts(old->ucounts, UCOUNT_RLIMIT_NPROC, 1); 507 alter_cred_subscribers(old, -2); 508 509 /* send notifications */ 510 if (!uid_eq(new->uid, old->uid) || 511 !uid_eq(new->euid, old->euid) || 512 !uid_eq(new->suid, old->suid) || 513 !uid_eq(new->fsuid, old->fsuid)) 514 proc_id_connector(task, PROC_EVENT_UID); 515 516 if (!gid_eq(new->gid, old->gid) || 517 !gid_eq(new->egid, old->egid) || 518 !gid_eq(new->sgid, old->sgid) || 519 !gid_eq(new->fsgid, old->fsgid)) 520 proc_id_connector(task, PROC_EVENT_GID); 521 522 /* release the old obj and subj refs both */ 523 put_cred(old); 524 put_cred(old); 525 return 0; 526 } 527 EXPORT_SYMBOL(commit_creds); 528 529 /** 530 * abort_creds - Discard a set of credentials and unlock the current task 531 * @new: The credentials that were going to be applied 532 * 533 * Discard a set of credentials that were under construction and unlock the 534 * current task. 535 */ 536 void abort_creds(struct cred *new) 537 { 538 kdebug("abort_creds(%p{%d,%d})", new, 539 atomic_read(&new->usage), 540 read_cred_subscribers(new)); 541 542 #ifdef CONFIG_DEBUG_CREDENTIALS 543 BUG_ON(read_cred_subscribers(new) != 0); 544 #endif 545 BUG_ON(atomic_read(&new->usage) < 1); 546 put_cred(new); 547 } 548 EXPORT_SYMBOL(abort_creds); 549 550 /** 551 * override_creds - Override the current process's subjective credentials 552 * @new: The credentials to be assigned 553 * 554 * Install a set of temporary override subjective credentials on the current 555 * process, returning the old set for later reversion. 556 */ 557 const struct cred *override_creds(const struct cred *new) 558 { 559 const struct cred *old = current->cred; 560 561 kdebug("override_creds(%p{%d,%d})", new, 562 atomic_read(&new->usage), 563 read_cred_subscribers(new)); 564 565 validate_creds(old); 566 validate_creds(new); 567 568 /* 569 * NOTE! This uses 'get_new_cred()' rather than 'get_cred()'. 570 * 571 * That means that we do not clear the 'non_rcu' flag, since 572 * we are only installing the cred into the thread-synchronous 573 * '->cred' pointer, not the '->real_cred' pointer that is 574 * visible to other threads under RCU. 575 * 576 * Also note that we did validate_creds() manually, not depending 577 * on the validation in 'get_cred()'. 578 */ 579 get_new_cred((struct cred *)new); 580 alter_cred_subscribers(new, 1); 581 rcu_assign_pointer(current->cred, new); 582 alter_cred_subscribers(old, -1); 583 584 kdebug("override_creds() = %p{%d,%d}", old, 585 atomic_read(&old->usage), 586 read_cred_subscribers(old)); 587 return old; 588 } 589 EXPORT_SYMBOL(override_creds); 590 591 /** 592 * revert_creds - Revert a temporary subjective credentials override 593 * @old: The credentials to be restored 594 * 595 * Revert a temporary set of override subjective credentials to an old set, 596 * discarding the override set. 597 */ 598 void revert_creds(const struct cred *old) 599 { 600 const struct cred *override = current->cred; 601 602 kdebug("revert_creds(%p{%d,%d})", old, 603 atomic_read(&old->usage), 604 read_cred_subscribers(old)); 605 606 validate_creds(old); 607 validate_creds(override); 608 alter_cred_subscribers(old, 1); 609 rcu_assign_pointer(current->cred, old); 610 alter_cred_subscribers(override, -1); 611 put_cred(override); 612 } 613 EXPORT_SYMBOL(revert_creds); 614 615 /** 616 * cred_fscmp - Compare two credentials with respect to filesystem access. 617 * @a: The first credential 618 * @b: The second credential 619 * 620 * cred_cmp() will return zero if both credentials have the same 621 * fsuid, fsgid, and supplementary groups. That is, if they will both 622 * provide the same access to files based on mode/uid/gid. 623 * If the credentials are different, then either -1 or 1 will 624 * be returned depending on whether @a comes before or after @b 625 * respectively in an arbitrary, but stable, ordering of credentials. 626 * 627 * Return: -1, 0, or 1 depending on comparison 628 */ 629 int cred_fscmp(const struct cred *a, const struct cred *b) 630 { 631 struct group_info *ga, *gb; 632 int g; 633 634 if (a == b) 635 return 0; 636 if (uid_lt(a->fsuid, b->fsuid)) 637 return -1; 638 if (uid_gt(a->fsuid, b->fsuid)) 639 return 1; 640 641 if (gid_lt(a->fsgid, b->fsgid)) 642 return -1; 643 if (gid_gt(a->fsgid, b->fsgid)) 644 return 1; 645 646 ga = a->group_info; 647 gb = b->group_info; 648 if (ga == gb) 649 return 0; 650 if (ga == NULL) 651 return -1; 652 if (gb == NULL) 653 return 1; 654 if (ga->ngroups < gb->ngroups) 655 return -1; 656 if (ga->ngroups > gb->ngroups) 657 return 1; 658 659 for (g = 0; g < ga->ngroups; g++) { 660 if (gid_lt(ga->gid[g], gb->gid[g])) 661 return -1; 662 if (gid_gt(ga->gid[g], gb->gid[g])) 663 return 1; 664 } 665 return 0; 666 } 667 EXPORT_SYMBOL(cred_fscmp); 668 669 int set_cred_ucounts(struct cred *new) 670 { 671 struct ucounts *new_ucounts, *old_ucounts = new->ucounts; 672 673 /* 674 * This optimization is needed because alloc_ucounts() uses locks 675 * for table lookups. 676 */ 677 if (old_ucounts->ns == new->user_ns && uid_eq(old_ucounts->uid, new->uid)) 678 return 0; 679 680 if (!(new_ucounts = alloc_ucounts(new->user_ns, new->uid))) 681 return -EAGAIN; 682 683 new->ucounts = new_ucounts; 684 put_ucounts(old_ucounts); 685 686 return 0; 687 } 688 689 /* 690 * initialise the credentials stuff 691 */ 692 void __init cred_init(void) 693 { 694 /* allocate a slab in which we can store credentials */ 695 cred_jar = kmem_cache_create("cred_jar", sizeof(struct cred), 0, 696 SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, NULL); 697 } 698 699 /** 700 * prepare_kernel_cred - Prepare a set of credentials for a kernel service 701 * @daemon: A userspace daemon to be used as a reference 702 * 703 * Prepare a set of credentials for a kernel service. This can then be used to 704 * override a task's own credentials so that work can be done on behalf of that 705 * task that requires a different subjective context. 706 * 707 * @daemon is used to provide a base cred, with the security data derived from 708 * that; if this is "&init_task", they'll be set to 0, no groups, full 709 * capabilities, and no keys. 710 * 711 * The caller may change these controls afterwards if desired. 712 * 713 * Returns the new credentials or NULL if out of memory. 714 */ 715 struct cred *prepare_kernel_cred(struct task_struct *daemon) 716 { 717 const struct cred *old; 718 struct cred *new; 719 720 if (WARN_ON_ONCE(!daemon)) 721 return NULL; 722 723 new = kmem_cache_alloc(cred_jar, GFP_KERNEL); 724 if (!new) 725 return NULL; 726 727 kdebug("prepare_kernel_cred() alloc %p", new); 728 729 old = get_task_cred(daemon); 730 validate_creds(old); 731 732 *new = *old; 733 new->non_rcu = 0; 734 atomic_set(&new->usage, 1); 735 set_cred_subscribers(new, 0); 736 get_uid(new->user); 737 get_user_ns(new->user_ns); 738 get_group_info(new->group_info); 739 740 #ifdef CONFIG_KEYS 741 new->session_keyring = NULL; 742 new->process_keyring = NULL; 743 new->thread_keyring = NULL; 744 new->request_key_auth = NULL; 745 new->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING; 746 #endif 747 748 #ifdef CONFIG_SECURITY 749 new->security = NULL; 750 #endif 751 new->ucounts = get_ucounts(new->ucounts); 752 if (!new->ucounts) 753 goto error; 754 755 if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0) 756 goto error; 757 758 put_cred(old); 759 validate_creds(new); 760 return new; 761 762 error: 763 put_cred(new); 764 put_cred(old); 765 return NULL; 766 } 767 EXPORT_SYMBOL(prepare_kernel_cred); 768 769 /** 770 * set_security_override - Set the security ID in a set of credentials 771 * @new: The credentials to alter 772 * @secid: The LSM security ID to set 773 * 774 * Set the LSM security ID in a set of credentials so that the subjective 775 * security is overridden when an alternative set of credentials is used. 776 */ 777 int set_security_override(struct cred *new, u32 secid) 778 { 779 return security_kernel_act_as(new, secid); 780 } 781 EXPORT_SYMBOL(set_security_override); 782 783 /** 784 * set_security_override_from_ctx - Set the security ID in a set of credentials 785 * @new: The credentials to alter 786 * @secctx: The LSM security context to generate the security ID from. 787 * 788 * Set the LSM security ID in a set of credentials so that the subjective 789 * security is overridden when an alternative set of credentials is used. The 790 * security ID is specified in string form as a security context to be 791 * interpreted by the LSM. 792 */ 793 int set_security_override_from_ctx(struct cred *new, const char *secctx) 794 { 795 u32 secid; 796 int ret; 797 798 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid); 799 if (ret < 0) 800 return ret; 801 802 return set_security_override(new, secid); 803 } 804 EXPORT_SYMBOL(set_security_override_from_ctx); 805 806 /** 807 * set_create_files_as - Set the LSM file create context in a set of credentials 808 * @new: The credentials to alter 809 * @inode: The inode to take the context from 810 * 811 * Change the LSM file creation context in a set of credentials to be the same 812 * as the object context of the specified inode, so that the new inodes have 813 * the same MAC context as that inode. 814 */ 815 int set_create_files_as(struct cred *new, struct inode *inode) 816 { 817 if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid)) 818 return -EINVAL; 819 new->fsuid = inode->i_uid; 820 new->fsgid = inode->i_gid; 821 return security_kernel_create_files_as(new, inode); 822 } 823 EXPORT_SYMBOL(set_create_files_as); 824 825 #ifdef CONFIG_DEBUG_CREDENTIALS 826 827 bool creds_are_invalid(const struct cred *cred) 828 { 829 if (cred->magic != CRED_MAGIC) 830 return true; 831 return false; 832 } 833 EXPORT_SYMBOL(creds_are_invalid); 834 835 /* 836 * dump invalid credentials 837 */ 838 static void dump_invalid_creds(const struct cred *cred, const char *label, 839 const struct task_struct *tsk) 840 { 841 pr_err("%s credentials: %p %s%s%s\n", 842 label, cred, 843 cred == &init_cred ? "[init]" : "", 844 cred == tsk->real_cred ? "[real]" : "", 845 cred == tsk->cred ? "[eff]" : ""); 846 pr_err("->magic=%x, put_addr=%p\n", 847 cred->magic, cred->put_addr); 848 pr_err("->usage=%d, subscr=%d\n", 849 atomic_read(&cred->usage), 850 read_cred_subscribers(cred)); 851 pr_err("->*uid = { %d,%d,%d,%d }\n", 852 from_kuid_munged(&init_user_ns, cred->uid), 853 from_kuid_munged(&init_user_ns, cred->euid), 854 from_kuid_munged(&init_user_ns, cred->suid), 855 from_kuid_munged(&init_user_ns, cred->fsuid)); 856 pr_err("->*gid = { %d,%d,%d,%d }\n", 857 from_kgid_munged(&init_user_ns, cred->gid), 858 from_kgid_munged(&init_user_ns, cred->egid), 859 from_kgid_munged(&init_user_ns, cred->sgid), 860 from_kgid_munged(&init_user_ns, cred->fsgid)); 861 #ifdef CONFIG_SECURITY 862 pr_err("->security is %p\n", cred->security); 863 if ((unsigned long) cred->security >= PAGE_SIZE && 864 (((unsigned long) cred->security & 0xffffff00) != 865 (POISON_FREE << 24 | POISON_FREE << 16 | POISON_FREE << 8))) 866 pr_err("->security {%x, %x}\n", 867 ((u32*)cred->security)[0], 868 ((u32*)cred->security)[1]); 869 #endif 870 } 871 872 /* 873 * report use of invalid credentials 874 */ 875 void __noreturn __invalid_creds(const struct cred *cred, const char *file, unsigned line) 876 { 877 pr_err("Invalid credentials\n"); 878 pr_err("At %s:%u\n", file, line); 879 dump_invalid_creds(cred, "Specified", current); 880 BUG(); 881 } 882 EXPORT_SYMBOL(__invalid_creds); 883 884 /* 885 * check the credentials on a process 886 */ 887 void __validate_process_creds(struct task_struct *tsk, 888 const char *file, unsigned line) 889 { 890 if (tsk->cred == tsk->real_cred) { 891 if (unlikely(read_cred_subscribers(tsk->cred) < 2 || 892 creds_are_invalid(tsk->cred))) 893 goto invalid_creds; 894 } else { 895 if (unlikely(read_cred_subscribers(tsk->real_cred) < 1 || 896 read_cred_subscribers(tsk->cred) < 1 || 897 creds_are_invalid(tsk->real_cred) || 898 creds_are_invalid(tsk->cred))) 899 goto invalid_creds; 900 } 901 return; 902 903 invalid_creds: 904 pr_err("Invalid process credentials\n"); 905 pr_err("At %s:%u\n", file, line); 906 907 dump_invalid_creds(tsk->real_cred, "Real", tsk); 908 if (tsk->cred != tsk->real_cred) 909 dump_invalid_creds(tsk->cred, "Effective", tsk); 910 else 911 pr_err("Effective creds == Real creds\n"); 912 BUG(); 913 } 914 EXPORT_SYMBOL(__validate_process_creds); 915 916 /* 917 * check creds for do_exit() 918 */ 919 void validate_creds_for_do_exit(struct task_struct *tsk) 920 { 921 kdebug("validate_creds_for_do_exit(%p,%p{%d,%d})", 922 tsk->real_cred, tsk->cred, 923 atomic_read(&tsk->cred->usage), 924 read_cred_subscribers(tsk->cred)); 925 926 __validate_process_creds(tsk, __FILE__, __LINE__); 927 } 928 929 #endif /* CONFIG_DEBUG_CREDENTIALS */ 930