1
2
3
4
5
6
7
8
9
10
11
12#ifndef _LINUX_CRED_H
13#define _LINUX_CRED_H
14
15#include <linux/capability.h>
16#include <linux/init.h>
17#include <linux/key.h>
18#include <linux/selinux.h>
19#include <asm/atomic.h>
20
21struct user_struct;
22struct cred;
23struct inode;
24
25
26
27
28#define NGROUPS_SMALL 32
29#define NGROUPS_PER_BLOCK ((unsigned int)(PAGE_SIZE / sizeof(gid_t)))
30
31struct group_info {
32 atomic_t usage;
33 int ngroups;
34 int nblocks;
35 gid_t small_block[NGROUPS_SMALL];
36 gid_t *blocks[0];
37};
38
39
40
41
42
43
44
45
46
47
48static inline struct group_info *get_group_info(struct group_info *gi)
49{
50 atomic_inc(&gi->usage);
51 return gi;
52}
53
54
55
56
57
58#define put_group_info(group_info) \
59do { \
60 if (atomic_dec_and_test(&(group_info)->usage)) \
61 groups_free(group_info); \
62} while (0)
63
64extern struct group_info *groups_alloc(int);
65extern struct group_info init_groups;
66extern void groups_free(struct group_info *);
67extern int set_current_groups(struct group_info *);
68extern int set_groups(struct cred *, struct group_info *);
69extern int groups_search(const struct group_info *, gid_t);
70
71
72#define GROUP_AT(gi, i) \
73 ((gi)->blocks[(i) / NGROUPS_PER_BLOCK][(i) % NGROUPS_PER_BLOCK])
74
75extern int in_group_p(gid_t);
76extern int in_egroup_p(gid_t);
77
78
79
80
81
82#ifdef CONFIG_KEYS
83struct thread_group_cred {
84 atomic_t usage;
85 pid_t tgid;
86 spinlock_t lock;
87 struct key *session_keyring;
88 struct key *process_keyring;
89 struct rcu_head rcu;
90};
91#endif
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116struct cred {
117 atomic_t usage;
118#ifdef CONFIG_DEBUG_CREDENTIALS
119 atomic_t subscribers;
120 void *put_addr;
121 unsigned magic;
122#define CRED_MAGIC 0x43736564
123#define CRED_MAGIC_DEAD 0x44656144
124#endif
125 uid_t uid;
126 gid_t gid;
127 uid_t suid;
128 gid_t sgid;
129 uid_t euid;
130 gid_t egid;
131 uid_t fsuid;
132 gid_t fsgid;
133 unsigned securebits;
134 kernel_cap_t cap_inheritable;
135 kernel_cap_t cap_permitted;
136 kernel_cap_t cap_effective;
137 kernel_cap_t cap_bset;
138#ifdef CONFIG_KEYS
139 unsigned char jit_keyring;
140
141 struct key *thread_keyring;
142 struct key *request_key_auth;
143 struct thread_group_cred *tgcred;
144#endif
145#ifdef CONFIG_SECURITY
146 void *security;
147#endif
148 struct user_struct *user;
149 struct group_info *group_info;
150 struct rcu_head rcu;
151};
152
153extern void __put_cred(struct cred *);
154extern void exit_creds(struct task_struct *);
155extern int copy_creds(struct task_struct *, unsigned long);
156extern struct cred *cred_alloc_blank(void);
157extern struct cred *prepare_creds(void);
158extern struct cred *prepare_exec_creds(void);
159extern struct cred *prepare_usermodehelper_creds(void);
160extern int commit_creds(struct cred *);
161extern void abort_creds(struct cred *);
162extern const struct cred *override_creds(const struct cred *);
163extern void revert_creds(const struct cred *);
164extern struct cred *prepare_kernel_cred(struct task_struct *);
165extern int change_create_files_as(struct cred *, struct inode *);
166extern int set_security_override(struct cred *, u32);
167extern int set_security_override_from_ctx(struct cred *, const char *);
168extern int set_create_files_as(struct cred *, struct inode *);
169extern void __init cred_init(void);
170
171
172
173
174#ifdef CONFIG_DEBUG_CREDENTIALS
175extern void __invalid_creds(const struct cred *, const char *, unsigned);
176extern void __validate_process_creds(struct task_struct *,
177 const char *, unsigned);
178
179extern bool creds_are_invalid(const struct cred *cred);
180
181static inline void __validate_creds(const struct cred *cred,
182 const char *file, unsigned line)
183{
184 if (unlikely(creds_are_invalid(cred)))
185 __invalid_creds(cred, file, line);
186}
187
188#define validate_creds(cred) \
189do { \
190 __validate_creds((cred), __FILE__, __LINE__); \
191} while(0)
192
193#define validate_process_creds() \
194do { \
195 __validate_process_creds(current, __FILE__, __LINE__); \
196} while(0)
197
198extern void validate_creds_for_do_exit(struct task_struct *);
199#else
200static inline void validate_creds(const struct cred *cred)
201{
202}
203static inline void validate_creds_for_do_exit(struct task_struct *tsk)
204{
205}
206static inline void validate_process_creds(void)
207{
208}
209#endif
210
211
212
213
214
215
216
217
218static inline struct cred *get_new_cred(struct cred *cred)
219{
220 atomic_inc(&cred->usage);
221 return cred;
222}
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237static inline const struct cred *get_cred(const struct cred *cred)
238{
239 struct cred *nonconst_cred = (struct cred *) cred;
240 validate_creds(cred);
241 return get_new_cred(nonconst_cred);
242}
243
244
245
246
247
248
249
250
251
252
253
254
255static inline void put_cred(const struct cred *_cred)
256{
257 struct cred *cred = (struct cred *) _cred;
258
259 validate_creds(cred);
260 if (atomic_dec_and_test(&(cred)->usage))
261 __put_cred(cred);
262}
263
264
265
266
267
268
269#define current_cred() \
270 (current->cred)
271
272
273
274
275
276
277
278
279
280
281
282#define __task_cred(task) \
283 ((const struct cred *)(rcu_dereference((task)->real_cred)))
284
285
286
287
288
289
290
291
292
293
294
295#define get_task_cred(task) \
296({ \
297 struct cred *__cred; \
298 rcu_read_lock(); \
299 __cred = (struct cred *) __task_cred((task)); \
300 get_cred(__cred); \
301 rcu_read_unlock(); \
302 __cred; \
303})
304
305
306
307
308
309
310
311
312#define get_current_cred() \
313 (get_cred(current_cred()))
314
315
316
317
318
319
320
321#define get_current_user() \
322({ \
323 struct user_struct *__u; \
324 struct cred *__cred; \
325 __cred = (struct cred *) current_cred(); \
326 __u = get_uid(__cred->user); \
327 __u; \
328})
329
330
331
332
333
334
335
336#define get_current_groups() \
337({ \
338 struct group_info *__groups; \
339 struct cred *__cred; \
340 __cred = (struct cred *) current_cred(); \
341 __groups = get_group_info(__cred->group_info); \
342 __groups; \
343})
344
345#define task_cred_xxx(task, xxx) \
346({ \
347 __typeof__(((struct cred *)NULL)->xxx) ___val; \
348 rcu_read_lock(); \
349 ___val = __task_cred((task))->xxx; \
350 rcu_read_unlock(); \
351 ___val; \
352})
353
354#define task_uid(task) (task_cred_xxx((task), uid))
355#define task_euid(task) (task_cred_xxx((task), euid))
356
357#define current_cred_xxx(xxx) \
358({ \
359 current->cred->xxx; \
360})
361
362#define current_uid() (current_cred_xxx(uid))
363#define current_gid() (current_cred_xxx(gid))
364#define current_euid() (current_cred_xxx(euid))
365#define current_egid() (current_cred_xxx(egid))
366#define current_suid() (current_cred_xxx(suid))
367#define current_sgid() (current_cred_xxx(sgid))
368#define current_fsuid() (current_cred_xxx(fsuid))
369#define current_fsgid() (current_cred_xxx(fsgid))
370#define current_cap() (current_cred_xxx(cap_effective))
371#define current_user() (current_cred_xxx(user))
372#define current_user_ns() (current_cred_xxx(user)->user_ns)
373#define current_security() (current_cred_xxx(security))
374
375#define current_uid_gid(_uid, _gid) \
376do { \
377 const struct cred *__cred; \
378 __cred = current_cred(); \
379 *(_uid) = __cred->uid; \
380 *(_gid) = __cred->gid; \
381} while(0)
382
383#define current_euid_egid(_euid, _egid) \
384do { \
385 const struct cred *__cred; \
386 __cred = current_cred(); \
387 *(_euid) = __cred->euid; \
388 *(_egid) = __cred->egid; \
389} while(0)
390
391#define current_fsuid_fsgid(_fsuid, _fsgid) \
392do { \
393 const struct cred *__cred; \
394 __cred = current_cred(); \
395 *(_fsuid) = __cred->fsuid; \
396 *(_fsgid) = __cred->fsgid; \
397} while(0)
398
399#endif
400