1
2
3
4
5
6
7
8
9
10
11
12#ifndef _LINUX_CRED_H
13#define _LINUX_CRED_H
14
15#include <linux/capability.h>
16#include <linux/init.h>
17#include <linux/key.h>
18#include <linux/selinux.h>
19#include <linux/atomic.h>
20#include <linux/uidgid.h>
21#include <linux/rh_kabi.h>
22
23struct user_struct;
24struct cred;
25struct inode;
26
27
28
29
30#define NGROUPS_SMALL 32
31#define NGROUPS_PER_BLOCK ((unsigned int)(PAGE_SIZE / sizeof(kgid_t)))
32
33struct group_info {
34 atomic_t usage;
35 int ngroups;
36 int nblocks;
37 kgid_t small_block[NGROUPS_SMALL];
38 kgid_t *blocks[0];
39};
40
41
42
43
44
45
46
47
48
49
50static inline struct group_info *get_group_info(struct group_info *gi)
51{
52 atomic_inc(&gi->usage);
53 return gi;
54}
55
56
57
58
59
60#define put_group_info(group_info) \
61do { \
62 if (atomic_dec_and_test(&(group_info)->usage)) \
63 groups_free(group_info); \
64} while (0)
65
66extern struct group_info *groups_alloc(int);
67extern struct group_info init_groups;
68extern void groups_free(struct group_info *);
69extern int set_current_groups(struct group_info *);
70extern int set_groups(struct cred *, struct group_info *);
71extern int groups_search(const struct group_info *, kgid_t);
72extern bool may_setgroups(void);
73extern void groups_sort(struct group_info *);
74
75
76#define GROUP_AT(gi, i) \
77 ((gi)->blocks[(i) / NGROUPS_PER_BLOCK][(i) % NGROUPS_PER_BLOCK])
78
79extern int in_group_p(kgid_t);
80extern int in_egroup_p(kgid_t);
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105struct cred {
106 atomic_t usage;
107#ifdef CONFIG_DEBUG_CREDENTIALS
108 atomic_t subscribers;
109 void *put_addr;
110 unsigned magic;
111#define CRED_MAGIC 0x43736564
112#define CRED_MAGIC_DEAD 0x44656144
113#endif
114 kuid_t uid;
115 kgid_t gid;
116 kuid_t suid;
117 kgid_t sgid;
118 kuid_t euid;
119 kgid_t egid;
120 kuid_t fsuid;
121 kgid_t fsgid;
122 unsigned securebits;
123 kernel_cap_t cap_inheritable;
124 kernel_cap_t cap_permitted;
125 kernel_cap_t cap_effective;
126 kernel_cap_t cap_bset;
127#ifdef CONFIG_KEYS
128 unsigned char jit_keyring;
129
130 struct key __rcu *session_keyring;
131 struct key *process_keyring;
132 struct key *thread_keyring;
133 struct key *request_key_auth;
134#endif
135#ifdef CONFIG_SECURITY
136 void *security;
137#endif
138 struct user_struct *user;
139 struct user_namespace *user_ns;
140 struct group_info *group_info;
141 struct rcu_head rcu;
142
143 RH_KABI_EXTEND(kernel_cap_t cap_ambient)
144};
145
146extern void __put_cred(struct cred *);
147extern void exit_creds(struct task_struct *);
148extern int copy_creds(struct task_struct *, unsigned long);
149extern const struct cred *get_task_cred(struct task_struct *);
150extern struct cred *cred_alloc_blank(void);
151extern struct cred *prepare_creds(void);
152extern struct cred *prepare_exec_creds(void);
153extern int commit_creds(struct cred *);
154extern void abort_creds(struct cred *);
155extern const struct cred *override_creds(const struct cred *);
156extern void revert_creds(const struct cred *);
157extern struct cred *prepare_kernel_cred(struct task_struct *);
158extern int change_create_files_as(struct cred *, struct inode *);
159extern int set_security_override(struct cred *, u32);
160extern int set_security_override_from_ctx(struct cred *, const char *);
161extern int set_create_files_as(struct cred *, struct inode *);
162extern void __init cred_init(void);
163
164
165
166
167#ifdef CONFIG_DEBUG_CREDENTIALS
168extern void __invalid_creds(const struct cred *, const char *, unsigned);
169extern void __validate_process_creds(struct task_struct *,
170 const char *, unsigned);
171
172extern bool creds_are_invalid(const struct cred *cred);
173
174static inline void __validate_creds(const struct cred *cred,
175 const char *file, unsigned line)
176{
177 if (unlikely(creds_are_invalid(cred)))
178 __invalid_creds(cred, file, line);
179}
180
181#define validate_creds(cred) \
182do { \
183 __validate_creds((cred), __FILE__, __LINE__); \
184} while(0)
185
186#define validate_process_creds() \
187do { \
188 __validate_process_creds(current, __FILE__, __LINE__); \
189} while(0)
190
191extern void validate_creds_for_do_exit(struct task_struct *);
192#else
193static inline void validate_creds(const struct cred *cred)
194{
195}
196static inline void validate_creds_for_do_exit(struct task_struct *tsk)
197{
198}
199static inline void validate_process_creds(void)
200{
201}
202#endif
203
204static inline bool cap_ambient_invariant_ok(const struct cred *cred)
205{
206 return cap_issubset(cred->cap_ambient,
207 cap_intersect(cred->cap_permitted,
208 cred->cap_inheritable));
209}
210
211
212
213
214
215
216
217
218static inline struct cred *get_new_cred(struct cred *cred)
219{
220 atomic_inc(&cred->usage);
221 return cred;
222}
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237static inline const struct cred *get_cred(const struct cred *cred)
238{
239 struct cred *nonconst_cred = (struct cred *) cred;
240 validate_creds(cred);
241 return get_new_cred(nonconst_cred);
242}
243
244
245
246
247
248
249
250
251
252
253
254
255static inline void put_cred(const struct cred *_cred)
256{
257 struct cred *cred = (struct cred *) _cred;
258
259 validate_creds(cred);
260 if (atomic_dec_and_test(&(cred)->usage))
261 __put_cred(cred);
262}
263
264
265
266
267
268
269
270#define current_cred() \
271 rcu_dereference_protected(current->cred, 1)
272
273
274
275
276
277
278
279#define current_real_cred() \
280 rcu_dereference_protected(current->real_cred, 1)
281
282
283
284
285
286
287
288
289
290
291
292#define __task_cred(task) \
293 rcu_dereference((task)->real_cred)
294
295
296
297
298
299
300
301
302#define get_current_cred() \
303 (get_cred(current_cred()))
304
305
306
307
308
309
310
311#define get_current_user() \
312({ \
313 struct user_struct *__u; \
314 const struct cred *__cred; \
315 __cred = current_cred(); \
316 __u = get_uid(__cred->user); \
317 __u; \
318})
319
320
321
322
323
324
325
326#define get_current_groups() \
327({ \
328 struct group_info *__groups; \
329 const struct cred *__cred; \
330 __cred = current_cred(); \
331 __groups = get_group_info(__cred->group_info); \
332 __groups; \
333})
334
335#define task_cred_xxx(task, xxx) \
336({ \
337 __typeof__(((struct cred *)NULL)->xxx) ___val; \
338 rcu_read_lock(); \
339 ___val = __task_cred((task))->xxx; \
340 rcu_read_unlock(); \
341 ___val; \
342})
343
344#define task_uid(task) (task_cred_xxx((task), uid))
345#define task_euid(task) (task_cred_xxx((task), euid))
346
347#define current_cred_xxx(xxx) \
348({ \
349 current_cred()->xxx; \
350})
351
352#define current_uid() (current_cred_xxx(uid))
353#define current_gid() (current_cred_xxx(gid))
354#define current_euid() (current_cred_xxx(euid))
355#define current_egid() (current_cred_xxx(egid))
356#define current_suid() (current_cred_xxx(suid))
357#define current_sgid() (current_cred_xxx(sgid))
358#define current_fsuid() (current_cred_xxx(fsuid))
359#define current_fsgid() (current_cred_xxx(fsgid))
360#define current_cap() (current_cred_xxx(cap_effective))
361#define current_user() (current_cred_xxx(user))
362#define current_security() (current_cred_xxx(security))
363
364extern struct user_namespace init_user_ns;
365#ifdef CONFIG_USER_NS
366#define current_user_ns() (current_cred_xxx(user_ns))
367#else
368#define current_user_ns() (&init_user_ns)
369#endif
370
371
372#define current_uid_gid(_uid, _gid) \
373do { \
374 const struct cred *__cred; \
375 __cred = current_cred(); \
376 *(_uid) = __cred->uid; \
377 *(_gid) = __cred->gid; \
378} while(0)
379
380#define current_euid_egid(_euid, _egid) \
381do { \
382 const struct cred *__cred; \
383 __cred = current_cred(); \
384 *(_euid) = __cred->euid; \
385 *(_egid) = __cred->egid; \
386} while(0)
387
388#define current_fsuid_fsgid(_fsuid, _fsgid) \
389do { \
390 const struct cred *__cred; \
391 __cred = current_cred(); \
392 *(_fsuid) = __cred->fsuid; \
393 *(_fsgid) = __cred->fsgid; \
394} while(0)
395
396#endif
397