1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* scm.c - Socket level control messages processing. 3 * 4 * Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> 5 * Alignment and value checking mods by Craig Metz 6 */ 7 8 #include <linux/module.h> 9 #include <linux/signal.h> 10 #include <linux/capability.h> 11 #include <linux/errno.h> 12 #include <linux/sched.h> 13 #include <linux/sched/user.h> 14 #include <linux/mm.h> 15 #include <linux/kernel.h> 16 #include <linux/stat.h> 17 #include <linux/socket.h> 18 #include <linux/file.h> 19 #include <linux/fcntl.h> 20 #include <linux/net.h> 21 #include <linux/interrupt.h> 22 #include <linux/netdevice.h> 23 #include <linux/security.h> 24 #include <linux/pid_namespace.h> 25 #include <linux/pid.h> 26 #include <uapi/linux/pidfd.h> 27 #include <linux/pidfs.h> 28 #include <linux/nsproxy.h> 29 #include <linux/slab.h> 30 #include <linux/errqueue.h> 31 #include <linux/io_uring.h> 32 33 #include <linux/uaccess.h> 34 35 #include <net/protocol.h> 36 #include <linux/skbuff.h> 37 #include <net/sock.h> 38 #include <net/compat.h> 39 #include <net/scm.h> 40 #include <net/cls_cgroup.h> 41 #include <net/af_unix.h> 42 43 44 /* 45 * Only allow a user to send credentials, that they could set with 46 * setu(g)id. 47 */ 48 49 static __inline__ int scm_check_creds(struct ucred *creds) 50 { 51 const struct cred *cred = current_cred(); 52 kuid_t uid = make_kuid(cred->user_ns, creds->uid); 53 kgid_t gid = make_kgid(cred->user_ns, creds->gid); 54 55 if (!uid_valid(uid) || !gid_valid(gid)) 56 return -EINVAL; 57 58 if ((creds->pid == task_tgid_vnr(current) || 59 ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) && 60 ((uid_eq(uid, cred->uid) || uid_eq(uid, cred->euid) || 61 uid_eq(uid, cred->suid)) || ns_capable(cred->user_ns, CAP_SETUID)) && 62 ((gid_eq(gid, cred->gid) || gid_eq(gid, cred->egid) || 63 gid_eq(gid, cred->sgid)) || ns_capable(cred->user_ns, CAP_SETGID))) { 64 return 0; 65 } 66 return -EPERM; 67 } 68 69 static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) 70 { 71 int *fdp = (int*)CMSG_DATA(cmsg); 72 struct scm_fp_list *fpl = *fplp; 73 struct file **fpp; 74 int i, num; 75 76 num = (cmsg->cmsg_len - sizeof(struct cmsghdr))/sizeof(int); 77 78 if (num <= 0) 79 return 0; 80 81 if (num > SCM_MAX_FD) 82 return -EINVAL; 83 84 if (!fpl) 85 { 86 fpl = kmalloc_obj(struct scm_fp_list, GFP_KERNEL_ACCOUNT); 87 if (!fpl) 88 return -ENOMEM; 89 *fplp = fpl; 90 fpl->count = 0; 91 fpl->count_unix = 0; 92 fpl->max = SCM_MAX_FD; 93 fpl->user = NULL; 94 #if IS_ENABLED(CONFIG_UNIX) 95 fpl->inflight = false; 96 fpl->dead = false; 97 fpl->edges = NULL; 98 INIT_LIST_HEAD(&fpl->vertices); 99 #endif 100 } 101 fpp = &fpl->fp[fpl->count]; 102 103 if (fpl->count + num > fpl->max) 104 return -EINVAL; 105 106 /* 107 * Verify the descriptors and increment the usage count. 108 */ 109 110 for (i=0; i< num; i++) 111 { 112 int fd = fdp[i]; 113 struct file *file; 114 115 if (fd < 0 || !(file = fget_raw(fd))) 116 return -EBADF; 117 /* don't allow io_uring files */ 118 if (io_is_uring_fops(file)) { 119 fput(file); 120 return -EINVAL; 121 } 122 if (unix_get_socket(file)) 123 fpl->count_unix++; 124 125 *fpp++ = file; 126 fpl->count++; 127 } 128 129 if (!fpl->user) 130 fpl->user = get_uid(current_user()); 131 132 return num; 133 } 134 135 void __scm_destroy(struct scm_cookie *scm) 136 { 137 struct scm_fp_list *fpl = scm->fp; 138 int i; 139 140 if (fpl) { 141 scm->fp = NULL; 142 for (i=fpl->count-1; i>=0; i--) 143 fput(fpl->fp[i]); 144 free_uid(fpl->user); 145 kfree(fpl); 146 } 147 } 148 EXPORT_SYMBOL(__scm_destroy); 149 150 static inline int scm_replace_pid(struct scm_cookie *scm, struct pid *pid) 151 { 152 struct pid *thread_pid; 153 int err; 154 155 /* drop all previous references */ 156 scm_destroy_cred(scm); 157 158 err = pidfs_register_pid(pid); 159 if (unlikely(err)) 160 return err; 161 162 /* A sender naming its own thread-group sends from the current thread. */ 163 if (pid == task_tgid(current)) 164 thread_pid = task_pid(current); 165 else 166 thread_pid = pid; 167 168 err = pidfs_register_pid(thread_pid); 169 if (unlikely(err)) 170 return err; 171 172 scm->pid[PIDTYPE_TGID] = pid; 173 scm->pid[PIDTYPE_PID] = get_pid(thread_pid); 174 scm->creds.pid = pid_vnr(pid); 175 return 0; 176 } 177 178 int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p) 179 { 180 const struct proto_ops *ops = READ_ONCE(sock->ops); 181 struct cmsghdr *cmsg; 182 int err; 183 184 for_each_cmsghdr(cmsg, msg) { 185 err = -EINVAL; 186 187 /* Verify that cmsg_len is at least sizeof(struct cmsghdr) */ 188 /* The first check was omitted in <= 2.2.5. The reasoning was 189 that parser checks cmsg_len in any case, so that 190 additional check would be work duplication. 191 But if cmsg_level is not SOL_SOCKET, we do not check 192 for too short ancillary data object at all! Oops. 193 OK, let's add it... 194 */ 195 if (!CMSG_OK(msg, cmsg)) 196 goto error; 197 198 if (cmsg->cmsg_level != SOL_SOCKET) 199 continue; 200 201 switch (cmsg->cmsg_type) 202 { 203 case SCM_RIGHTS: 204 if (!ops || ops->family != PF_UNIX) 205 goto error; 206 err=scm_fp_copy(cmsg, &p->fp); 207 if (err<0) 208 goto error; 209 break; 210 case SCM_CREDENTIALS: 211 { 212 struct ucred creds; 213 kuid_t uid; 214 kgid_t gid; 215 if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred))) 216 goto error; 217 memcpy(&creds, CMSG_DATA(cmsg), sizeof(struct ucred)); 218 err = scm_check_creds(&creds); 219 if (err) 220 goto error; 221 222 if (!p->pid[PIDTYPE_TGID] || 223 pid_vnr(p->pid[PIDTYPE_TGID]) != creds.pid) { 224 struct pid *pid; 225 err = -ESRCH; 226 pid = find_get_pid(creds.pid); 227 if (!pid) 228 goto error; 229 230 /* pass a struct pid reference from 231 * find_get_pid() to scm_replace_pid(). 232 */ 233 err = scm_replace_pid(p, pid); 234 if (err) { 235 put_pid(pid); 236 goto error; 237 } 238 } 239 240 err = -EINVAL; 241 uid = make_kuid(current_user_ns(), creds.uid); 242 gid = make_kgid(current_user_ns(), creds.gid); 243 if (!uid_valid(uid) || !gid_valid(gid)) 244 goto error; 245 246 p->creds.uid = uid; 247 p->creds.gid = gid; 248 break; 249 } 250 default: 251 goto error; 252 } 253 } 254 255 if (p->fp && !p->fp->count) 256 { 257 kfree(p->fp); 258 p->fp = NULL; 259 } 260 return 0; 261 262 error: 263 scm_destroy(p); 264 return err; 265 } 266 EXPORT_SYMBOL(__scm_send); 267 268 int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data) 269 { 270 int cmlen = CMSG_LEN(len); 271 272 if (msg->msg_flags & MSG_CMSG_COMPAT) 273 return put_cmsg_compat(msg, level, type, len, data); 274 275 if (!msg->msg_control || msg->msg_controllen < sizeof(struct cmsghdr)) { 276 msg->msg_flags |= MSG_CTRUNC; 277 return 0; /* XXX: return error? check spec. */ 278 } 279 if (msg->msg_controllen < cmlen) { 280 msg->msg_flags |= MSG_CTRUNC; 281 cmlen = msg->msg_controllen; 282 } 283 284 if (msg->msg_control_is_user) { 285 struct cmsghdr __user *cm = msg->msg_control_user; 286 287 check_object_size(data, cmlen - sizeof(*cm), true); 288 289 scoped_user_write_access_size(cm, cmlen, efault) { 290 unsafe_put_user(cmlen, &cm->cmsg_len, efault); 291 unsafe_put_user(level, &cm->cmsg_level, efault); 292 unsafe_put_user(type, &cm->cmsg_type, efault); 293 unsafe_copy_to_user(CMSG_USER_DATA(cm), data, 294 cmlen - sizeof(*cm), efault); 295 } 296 } else { 297 struct cmsghdr *cm = msg->msg_control; 298 299 cm->cmsg_level = level; 300 cm->cmsg_type = type; 301 cm->cmsg_len = cmlen; 302 memcpy(CMSG_DATA(cm), data, cmlen - sizeof(*cm)); 303 } 304 305 cmlen = min(CMSG_SPACE(len), msg->msg_controllen); 306 if (msg->msg_control_is_user) 307 msg->msg_control_user += cmlen; 308 else 309 msg->msg_control += cmlen; 310 msg->msg_controllen -= cmlen; 311 return 0; 312 313 efault: 314 return -EFAULT; 315 } 316 EXPORT_SYMBOL(put_cmsg); 317 318 int put_cmsg_notrunc(struct msghdr *msg, int level, int type, int len, 319 void *data) 320 { 321 /* Don't produce truncated CMSGs */ 322 if (!msg->msg_control || msg->msg_controllen < CMSG_LEN(len)) 323 return -ETOOSMALL; 324 325 return put_cmsg(msg, level, type, len, data); 326 } 327 328 void put_cmsg_scm_timestamping64(struct msghdr *msg, struct scm_timestamping_internal *tss_internal) 329 { 330 struct scm_timestamping64 tss; 331 int i; 332 333 for (i = 0; i < ARRAY_SIZE(tss.ts); i++) { 334 struct timespec64 tv = ktime_to_timespec64(tss_internal->ts[i]); 335 336 tss.ts[i].tv_sec = tv.tv_sec; 337 tss.ts[i].tv_nsec = tv.tv_nsec; 338 } 339 340 put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPING_NEW, sizeof(tss), &tss); 341 } 342 EXPORT_SYMBOL(put_cmsg_scm_timestamping64); 343 344 void put_cmsg_scm_timestamping(struct msghdr *msg, struct scm_timestamping_internal *tss_internal) 345 { 346 struct scm_timestamping tss; 347 int i; 348 349 for (i = 0; i < ARRAY_SIZE(tss.ts); i++) { 350 struct timespec64 tv = ktime_to_timespec64(tss_internal->ts[i]); 351 352 tss.ts[i].tv_sec = tv.tv_sec; 353 tss.ts[i].tv_nsec = tv.tv_nsec; 354 } 355 356 put_cmsg(msg, SOL_SOCKET, SO_TIMESTAMPING_OLD, sizeof(tss), &tss); 357 } 358 EXPORT_SYMBOL(put_cmsg_scm_timestamping); 359 360 static int scm_max_fds(struct msghdr *msg) 361 { 362 if (msg->msg_controllen <= sizeof(struct cmsghdr)) 363 return 0; 364 return (msg->msg_controllen - sizeof(struct cmsghdr)) / sizeof(int); 365 } 366 367 int scm_recv_one_fd(struct file *f, int __user *ufd, unsigned int flags, 368 bool notrunc) 369 { 370 int error; 371 372 if (!ufd) 373 return -EFAULT; 374 375 error = security_file_receive(f); 376 if (error) 377 return notrunc ? put_user(error, ufd) : error; 378 379 FD_PREPARE(fdf, flags, get_file(f)); 380 if (fdf->fd < 0) 381 return fdf->fd; 382 383 error = put_user(fdf->fd, ufd); 384 if (error) 385 return error; 386 387 __receive_sock(fdf->file); 388 return fd_publish(fdf); 389 } 390 391 void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm, bool notrunc) 392 { 393 struct cmsghdr __user *cm = 394 (__force struct cmsghdr __user *)msg->msg_control_user; 395 unsigned int o_flags = (msg->msg_flags & MSG_CMSG_CLOEXEC) ? O_CLOEXEC : 0; 396 int fdmax = min_t(int, scm_max_fds(msg), scm->fp->count); 397 int __user *cmsg_data = CMSG_USER_DATA(cm); 398 int err = 0, i; 399 400 /* no use for FD passing from kernel space callers */ 401 if (WARN_ON_ONCE(!msg->msg_control_is_user)) 402 return; 403 404 if (msg->msg_flags & MSG_CMSG_COMPAT) { 405 scm_detach_fds_compat(msg, scm, notrunc); 406 return; 407 } 408 409 for (i = 0; i < fdmax; i++) { 410 err = scm_recv_one_fd(scm->fp->fp[i], cmsg_data + i, o_flags, notrunc); 411 if (err < 0) 412 break; 413 } 414 415 if (i > 0) { 416 int cmlen = CMSG_LEN(i * sizeof(int)); 417 418 err = put_user(SOL_SOCKET, &cm->cmsg_level); 419 if (!err) 420 err = put_user(SCM_RIGHTS, &cm->cmsg_type); 421 if (!err) 422 err = put_user(cmlen, &cm->cmsg_len); 423 if (!err) { 424 cmlen = CMSG_SPACE(i * sizeof(int)); 425 if (msg->msg_controllen < cmlen) 426 cmlen = msg->msg_controllen; 427 msg->msg_control_user += cmlen; 428 msg->msg_controllen -= cmlen; 429 } 430 } 431 432 if (i < scm->fp->count || (scm->fp->count && fdmax <= 0)) 433 msg->msg_flags |= MSG_CTRUNC; 434 435 /* 436 * All of the files that fit in the message have had their usage counts 437 * incremented, so we just free the list. 438 */ 439 __scm_destroy(scm); 440 } 441 EXPORT_SYMBOL(scm_detach_fds); 442 443 struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl) 444 { 445 struct scm_fp_list *new_fpl; 446 int i; 447 448 if (!fpl) 449 return NULL; 450 451 new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]), 452 GFP_KERNEL_ACCOUNT); 453 if (new_fpl) { 454 for (i = 0; i < fpl->count; i++) 455 get_file(fpl->fp[i]); 456 457 new_fpl->max = new_fpl->count; 458 new_fpl->user = get_uid(fpl->user); 459 #if IS_ENABLED(CONFIG_UNIX) 460 new_fpl->inflight = false; 461 new_fpl->edges = NULL; 462 INIT_LIST_HEAD(&new_fpl->vertices); 463 #endif 464 } 465 return new_fpl; 466 } 467 EXPORT_SYMBOL(scm_fp_dup); 468 469 #ifdef CONFIG_SECURITY_NETWORK 470 static void scm_passec(struct sock *sk, struct msghdr *msg, struct scm_cookie *scm) 471 { 472 struct lsm_context ctx; 473 int err; 474 475 if (sk->sk_scm_security) { 476 err = security_secid_to_secctx(scm->secid, &ctx); 477 478 if (err >= 0) { 479 put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, ctx.len, 480 ctx.context); 481 482 security_release_secctx(&ctx); 483 } 484 } 485 } 486 487 static bool scm_has_secdata(struct sock *sk) 488 { 489 return sk->sk_scm_security; 490 } 491 #else 492 static void scm_passec(struct sock *sk, struct msghdr *msg, struct scm_cookie *scm) 493 { 494 } 495 496 static bool scm_has_secdata(struct sock *sk) 497 { 498 return false; 499 } 500 #endif 501 502 static void scm_pidfd_recv(struct msghdr *msg, struct scm_cookie *scm, 503 enum pid_type type, int cmsg_type) 504 { 505 unsigned int flags = PIDFD_STALE; 506 struct file *pidfd_file = NULL; 507 struct pid *pid; 508 int len, pidfd; 509 510 pid = scm->pid[type]; 511 512 /* put_cmsg() doesn't return an error if CMSG is truncated, 513 * that's why we need to opencode these checks here. 514 */ 515 if (msg->msg_flags & MSG_CMSG_COMPAT) 516 len = sizeof(struct compat_cmsghdr) + sizeof(int); 517 else 518 len = sizeof(struct cmsghdr) + sizeof(int); 519 520 if (msg->msg_controllen < len) { 521 msg->msg_flags |= MSG_CTRUNC; 522 return; 523 } 524 525 if (!pid) 526 return; 527 528 if (type == PIDTYPE_PID) 529 flags |= PIDFD_THREAD; 530 531 pidfd = pidfd_prepare(pid, flags, &pidfd_file); 532 533 if (put_cmsg(msg, SOL_SOCKET, cmsg_type, sizeof(int), &pidfd)) { 534 if (pidfd_file) { 535 put_unused_fd(pidfd); 536 fput(pidfd_file); 537 } 538 539 return; 540 } 541 542 if (pidfd_file) 543 fd_install(pidfd, pidfd_file); 544 } 545 546 static bool __scm_recv_common(struct sock *sk, struct msghdr *msg, 547 struct scm_cookie *scm, int flags) 548 { 549 if (!msg->msg_control) { 550 if (sk->sk_scm_credentials || sk->sk_scm_pidfd || 551 sk->sk_scm_pidfd_thread || scm->fp || scm_has_secdata(sk)) 552 msg->msg_flags |= MSG_CTRUNC; 553 554 scm_destroy(scm); 555 return false; 556 } 557 558 if (sk->sk_scm_credentials) { 559 struct user_namespace *current_ns = current_user_ns(); 560 struct ucred ucreds = { 561 .pid = scm->creds.pid, 562 .uid = from_kuid_munged(current_ns, scm->creds.uid), 563 .gid = from_kgid_munged(current_ns, scm->creds.gid), 564 }; 565 566 put_cmsg(msg, SOL_SOCKET, SCM_CREDENTIALS, sizeof(ucreds), &ucreds); 567 } 568 569 scm_passec(sk, msg, scm); 570 571 return true; 572 } 573 574 void scm_recv(struct socket *sock, struct msghdr *msg, 575 struct scm_cookie *scm, int flags) 576 { 577 if (!__scm_recv_common(sock->sk, msg, scm, flags)) 578 return; 579 580 scm_destroy_cred(scm); 581 } 582 EXPORT_SYMBOL(scm_recv); 583 584 void scm_recv_unix(struct socket *sock, struct msghdr *msg, 585 struct scm_cookie *scm, int flags) 586 { 587 if (!__scm_recv_common(sock->sk, msg, scm, flags)) 588 return; 589 590 if (scm->fp) { 591 struct unix_sock *u; 592 593 u = unix_sk(sock->sk); 594 scm_detach_fds(msg, scm, READ_ONCE(u->scm_rights_notrunc)); 595 } 596 597 if (sock->sk->sk_scm_pidfd) 598 scm_pidfd_recv(msg, scm, PIDTYPE_TGID, SCM_PIDFD); 599 600 if (sock->sk->sk_scm_pidfd_thread) 601 scm_pidfd_recv(msg, scm, PIDTYPE_PID, SCM_PIDFD_THREAD); 602 603 scm_destroy_cred(scm); 604 } 605