1 /* scm.c - Socket level control messages processing. 2 * 3 * Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru> 4 * Alignment and value checking mods by Craig Metz 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License 8 * as published by the Free Software Foundation; either version 9 * 2 of the License, or (at your option) any later version. 10 */ 11 12 #include <linux/module.h> 13 #include <linux/signal.h> 14 #include <linux/capability.h> 15 #include <linux/errno.h> 16 #include <linux/sched.h> 17 #include <linux/mm.h> 18 #include <linux/kernel.h> 19 #include <linux/stat.h> 20 #include <linux/socket.h> 21 #include <linux/file.h> 22 #include <linux/fcntl.h> 23 #include <linux/net.h> 24 #include <linux/interrupt.h> 25 #include <linux/netdevice.h> 26 #include <linux/security.h> 27 #include <linux/pid_namespace.h> 28 #include <linux/pid.h> 29 #include <linux/nsproxy.h> 30 #include <linux/slab.h> 31 32 #include <asm/uaccess.h> 33 34 #include <net/protocol.h> 35 #include <linux/skbuff.h> 36 #include <net/sock.h> 37 #include <net/compat.h> 38 #include <net/scm.h> 39 #include <net/cls_cgroup.h> 40 41 42 /* 43 * Only allow a user to send credentials, that they could set with 44 * setu(g)id. 45 */ 46 47 static __inline__ int scm_check_creds(struct ucred *creds) 48 { 49 const struct cred *cred = current_cred(); 50 kuid_t uid = make_kuid(cred->user_ns, creds->uid); 51 kgid_t gid = make_kgid(cred->user_ns, creds->gid); 52 53 if (!uid_valid(uid) || !gid_valid(gid)) 54 return -EINVAL; 55 56 if ((creds->pid == task_tgid_vnr(current) || 57 ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) && 58 ((uid_eq(uid, cred->uid) || uid_eq(uid, cred->euid) || 59 uid_eq(uid, cred->suid)) || ns_capable(cred->user_ns, CAP_SETUID)) && 60 ((gid_eq(gid, cred->gid) || gid_eq(gid, cred->egid) || 61 gid_eq(gid, cred->sgid)) || ns_capable(cred->user_ns, CAP_SETGID))) { 62 return 0; 63 } 64 return -EPERM; 65 } 66 67 static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp) 68 { 69 int *fdp = (int*)CMSG_DATA(cmsg); 70 struct scm_fp_list *fpl = *fplp; 71 struct file **fpp; 72 int i, num; 73 74 num = (cmsg->cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr)))/sizeof(int); 75 76 if (num <= 0) 77 return 0; 78 79 if (num > SCM_MAX_FD) 80 return -EINVAL; 81 82 if (!fpl) 83 { 84 fpl = kmalloc(sizeof(struct scm_fp_list), GFP_KERNEL); 85 if (!fpl) 86 return -ENOMEM; 87 *fplp = fpl; 88 fpl->count = 0; 89 fpl->max = SCM_MAX_FD; 90 } 91 fpp = &fpl->fp[fpl->count]; 92 93 if (fpl->count + num > fpl->max) 94 return -EINVAL; 95 96 /* 97 * Verify the descriptors and increment the usage count. 98 */ 99 100 for (i=0; i< num; i++) 101 { 102 int fd = fdp[i]; 103 struct file *file; 104 105 if (fd < 0 || !(file = fget_raw(fd))) 106 return -EBADF; 107 *fpp++ = file; 108 fpl->count++; 109 } 110 return num; 111 } 112 113 void __scm_destroy(struct scm_cookie *scm) 114 { 115 struct scm_fp_list *fpl = scm->fp; 116 int i; 117 118 if (fpl) { 119 scm->fp = NULL; 120 for (i=fpl->count-1; i>=0; i--) 121 fput(fpl->fp[i]); 122 kfree(fpl); 123 } 124 } 125 EXPORT_SYMBOL(__scm_destroy); 126 127 int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *p) 128 { 129 struct cmsghdr *cmsg; 130 int err; 131 132 for_each_cmsghdr(cmsg, msg) { 133 err = -EINVAL; 134 135 /* Verify that cmsg_len is at least sizeof(struct cmsghdr) */ 136 /* The first check was omitted in <= 2.2.5. The reasoning was 137 that parser checks cmsg_len in any case, so that 138 additional check would be work duplication. 139 But if cmsg_level is not SOL_SOCKET, we do not check 140 for too short ancillary data object at all! Oops. 141 OK, let's add it... 142 */ 143 if (!CMSG_OK(msg, cmsg)) 144 goto error; 145 146 if (cmsg->cmsg_level != SOL_SOCKET) 147 continue; 148 149 switch (cmsg->cmsg_type) 150 { 151 case SCM_RIGHTS: 152 if (!sock->ops || sock->ops->family != PF_UNIX) 153 goto error; 154 err=scm_fp_copy(cmsg, &p->fp); 155 if (err<0) 156 goto error; 157 break; 158 case SCM_CREDENTIALS: 159 { 160 struct ucred creds; 161 kuid_t uid; 162 kgid_t gid; 163 if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct ucred))) 164 goto error; 165 memcpy(&creds, CMSG_DATA(cmsg), sizeof(struct ucred)); 166 err = scm_check_creds(&creds); 167 if (err) 168 goto error; 169 170 p->creds.pid = creds.pid; 171 if (!p->pid || pid_vnr(p->pid) != creds.pid) { 172 struct pid *pid; 173 err = -ESRCH; 174 pid = find_get_pid(creds.pid); 175 if (!pid) 176 goto error; 177 put_pid(p->pid); 178 p->pid = pid; 179 } 180 181 err = -EINVAL; 182 uid = make_kuid(current_user_ns(), creds.uid); 183 gid = make_kgid(current_user_ns(), creds.gid); 184 if (!uid_valid(uid) || !gid_valid(gid)) 185 goto error; 186 187 p->creds.uid = uid; 188 p->creds.gid = gid; 189 break; 190 } 191 default: 192 goto error; 193 } 194 } 195 196 if (p->fp && !p->fp->count) 197 { 198 kfree(p->fp); 199 p->fp = NULL; 200 } 201 return 0; 202 203 error: 204 scm_destroy(p); 205 return err; 206 } 207 EXPORT_SYMBOL(__scm_send); 208 209 int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data) 210 { 211 struct cmsghdr __user *cm 212 = (__force struct cmsghdr __user *)msg->msg_control; 213 struct cmsghdr cmhdr; 214 int cmlen = CMSG_LEN(len); 215 int err; 216 217 if (MSG_CMSG_COMPAT & msg->msg_flags) 218 return put_cmsg_compat(msg, level, type, len, data); 219 220 if (cm==NULL || msg->msg_controllen < sizeof(*cm)) { 221 msg->msg_flags |= MSG_CTRUNC; 222 return 0; /* XXX: return error? check spec. */ 223 } 224 if (msg->msg_controllen < cmlen) { 225 msg->msg_flags |= MSG_CTRUNC; 226 cmlen = msg->msg_controllen; 227 } 228 cmhdr.cmsg_level = level; 229 cmhdr.cmsg_type = type; 230 cmhdr.cmsg_len = cmlen; 231 232 err = -EFAULT; 233 if (copy_to_user(cm, &cmhdr, sizeof cmhdr)) 234 goto out; 235 if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr))) 236 goto out; 237 cmlen = CMSG_SPACE(len); 238 if (msg->msg_controllen < cmlen) 239 cmlen = msg->msg_controllen; 240 msg->msg_control += cmlen; 241 msg->msg_controllen -= cmlen; 242 err = 0; 243 out: 244 return err; 245 } 246 EXPORT_SYMBOL(put_cmsg); 247 248 void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm) 249 { 250 struct cmsghdr __user *cm 251 = (__force struct cmsghdr __user*)msg->msg_control; 252 253 int fdmax = 0; 254 int fdnum = scm->fp->count; 255 struct file **fp = scm->fp->fp; 256 int __user *cmfptr; 257 int err = 0, i; 258 259 if (MSG_CMSG_COMPAT & msg->msg_flags) { 260 scm_detach_fds_compat(msg, scm); 261 return; 262 } 263 264 if (msg->msg_controllen > sizeof(struct cmsghdr)) 265 fdmax = ((msg->msg_controllen - sizeof(struct cmsghdr)) 266 / sizeof(int)); 267 268 if (fdnum < fdmax) 269 fdmax = fdnum; 270 271 for (i=0, cmfptr=(__force int __user *)CMSG_DATA(cm); i<fdmax; 272 i++, cmfptr++) 273 { 274 struct socket *sock; 275 int new_fd; 276 err = security_file_receive(fp[i]); 277 if (err) 278 break; 279 err = get_unused_fd_flags(MSG_CMSG_CLOEXEC & msg->msg_flags 280 ? O_CLOEXEC : 0); 281 if (err < 0) 282 break; 283 new_fd = err; 284 err = put_user(new_fd, cmfptr); 285 if (err) { 286 put_unused_fd(new_fd); 287 break; 288 } 289 /* Bump the usage count and install the file. */ 290 sock = sock_from_file(fp[i], &err); 291 if (sock) { 292 sock_update_netprioidx(sock->sk); 293 sock_update_classid(sock->sk); 294 } 295 fd_install(new_fd, get_file(fp[i])); 296 } 297 298 if (i > 0) 299 { 300 int cmlen = CMSG_LEN(i*sizeof(int)); 301 err = put_user(SOL_SOCKET, &cm->cmsg_level); 302 if (!err) 303 err = put_user(SCM_RIGHTS, &cm->cmsg_type); 304 if (!err) 305 err = put_user(cmlen, &cm->cmsg_len); 306 if (!err) { 307 cmlen = CMSG_SPACE(i*sizeof(int)); 308 msg->msg_control += cmlen; 309 msg->msg_controllen -= cmlen; 310 } 311 } 312 if (i < fdnum || (fdnum && fdmax <= 0)) 313 msg->msg_flags |= MSG_CTRUNC; 314 315 /* 316 * All of the files that fit in the message have had their 317 * usage counts incremented, so we just free the list. 318 */ 319 __scm_destroy(scm); 320 } 321 EXPORT_SYMBOL(scm_detach_fds); 322 323 struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl) 324 { 325 struct scm_fp_list *new_fpl; 326 int i; 327 328 if (!fpl) 329 return NULL; 330 331 new_fpl = kmemdup(fpl, offsetof(struct scm_fp_list, fp[fpl->count]), 332 GFP_KERNEL); 333 if (new_fpl) { 334 for (i = 0; i < fpl->count; i++) 335 get_file(fpl->fp[i]); 336 new_fpl->max = new_fpl->count; 337 } 338 return new_fpl; 339 } 340 EXPORT_SYMBOL(scm_fp_dup); 341