1
2
3
4
5
6
7
8
9
10
11#include <linux/module.h>
12#include <linux/cred.h>
13#include <linux/sched.h>
14#include <linux/key.h>
15#include <linux/keyctl.h>
16#include <linux/init_task.h>
17#include <linux/security.h>
18#include <linux/cn_proc.h>
19#include "cred-internals.h"
20
21#if 0
22#define kdebug(FMT, ...) \
23 printk("[%-5.5s%5u] "FMT"\n", current->comm, current->pid ,##__VA_ARGS__)
24#else
25static inline __attribute__((format(printf, 1, 2)))
26void no_printk(const char *fmt, ...)
27{
28}
29#define kdebug(FMT, ...) \
30 no_printk("[%-5.5s%5u] "FMT"\n", current->comm, current->pid ,##__VA_ARGS__)
31#endif
32
33static struct kmem_cache *cred_jar;
34
35
36
37
38#ifdef CONFIG_KEYS
39static struct thread_group_cred init_tgcred = {
40 .usage = ATOMIC_INIT(2),
41 .tgid = 0,
42 .lock = SPIN_LOCK_UNLOCKED,
43};
44#endif
45
46
47
48
49struct cred init_cred = {
50 .usage = ATOMIC_INIT(4),
51#ifdef CONFIG_DEBUG_CREDENTIALS
52 .subscribers = ATOMIC_INIT(2),
53 .magic = CRED_MAGIC,
54#endif
55 .securebits = SECUREBITS_DEFAULT,
56 .cap_inheritable = CAP_INIT_INH_SET,
57 .cap_permitted = CAP_FULL_SET,
58 .cap_effective = CAP_INIT_EFF_SET,
59 .cap_bset = CAP_INIT_BSET,
60 .user = INIT_USER,
61 .group_info = &init_groups,
62#ifdef CONFIG_KEYS
63 .tgcred = &init_tgcred,
64#endif
65};
66
67static inline void set_cred_subscribers(struct cred *cred, int n)
68{
69#ifdef CONFIG_DEBUG_CREDENTIALS
70 atomic_set(&cred->subscribers, n);
71#endif
72}
73
74static inline int read_cred_subscribers(const struct cred *cred)
75{
76#ifdef CONFIG_DEBUG_CREDENTIALS
77 return atomic_read(&cred->subscribers);
78#else
79 return 0;
80#endif
81}
82
83static inline void alter_cred_subscribers(const struct cred *_cred, int n)
84{
85#ifdef CONFIG_DEBUG_CREDENTIALS
86 struct cred *cred = (struct cred *) _cred;
87
88 atomic_add(n, &cred->subscribers);
89#endif
90}
91
92
93
94
95#ifdef CONFIG_KEYS
96static void release_tgcred_rcu(struct rcu_head *rcu)
97{
98 struct thread_group_cred *tgcred =
99 container_of(rcu, struct thread_group_cred, rcu);
100
101 BUG_ON(atomic_read(&tgcred->usage) != 0);
102
103 key_put(tgcred->session_keyring);
104 key_put(tgcred->process_keyring);
105 kfree(tgcred);
106}
107#endif
108
109
110
111
112static void release_tgcred(struct cred *cred)
113{
114#ifdef CONFIG_KEYS
115 struct thread_group_cred *tgcred = cred->tgcred;
116
117 if (atomic_dec_and_test(&tgcred->usage))
118 call_rcu(&tgcred->rcu, release_tgcred_rcu);
119#endif
120}
121
122
123
124
125static void put_cred_rcu(struct rcu_head *rcu)
126{
127 struct cred *cred = container_of(rcu, struct cred, rcu);
128
129 kdebug("put_cred_rcu(%p)", cred);
130
131#ifdef CONFIG_DEBUG_CREDENTIALS
132 if (cred->magic != CRED_MAGIC_DEAD ||
133 atomic_read(&cred->usage) != 0 ||
134 read_cred_subscribers(cred) != 0)
135 panic("CRED: put_cred_rcu() sees %p with"
136 " mag %x, put %p, usage %d, subscr %d\n",
137 cred, cred->magic, cred->put_addr,
138 atomic_read(&cred->usage),
139 read_cred_subscribers(cred));
140#else
141 if (atomic_read(&cred->usage) != 0)
142 panic("CRED: put_cred_rcu() sees %p with usage %d\n",
143 cred, atomic_read(&cred->usage));
144#endif
145
146 security_cred_free(cred);
147 key_put(cred->thread_keyring);
148 key_put(cred->request_key_auth);
149 release_tgcred(cred);
150 if (cred->group_info)
151 put_group_info(cred->group_info);
152 free_uid(cred->user);
153 kmem_cache_free(cred_jar, cred);
154}
155
156
157
158
159
160
161
162void __put_cred(struct cred *cred)
163{
164 kdebug("__put_cred(%p{%d,%d})", cred,
165 atomic_read(&cred->usage),
166 read_cred_subscribers(cred));
167
168 BUG_ON(atomic_read(&cred->usage) != 0);
169#ifdef CONFIG_DEBUG_CREDENTIALS
170 BUG_ON(read_cred_subscribers(cred) != 0);
171 cred->magic = CRED_MAGIC_DEAD;
172 cred->put_addr = __builtin_return_address(0);
173#endif
174 BUG_ON(cred == current->cred);
175 BUG_ON(cred == current->real_cred);
176
177 call_rcu(&cred->rcu, put_cred_rcu);
178}
179EXPORT_SYMBOL(__put_cred);
180
181
182
183
184void exit_creds(struct task_struct *tsk)
185{
186 struct cred *cred;
187
188 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
189 atomic_read(&tsk->cred->usage),
190 read_cred_subscribers(tsk->cred));
191
192 cred = (struct cred *) tsk->real_cred;
193 tsk->real_cred = NULL;
194 validate_creds(cred);
195 alter_cred_subscribers(cred, -1);
196 put_cred(cred);
197
198 cred = (struct cred *) tsk->cred;
199 tsk->cred = NULL;
200 validate_creds(cred);
201 alter_cred_subscribers(cred, -1);
202 put_cred(cred);
203
204 cred = (struct cred *) tsk->replacement_session_keyring;
205 if (cred) {
206 tsk->replacement_session_keyring = NULL;
207 validate_creds(cred);
208 put_cred(cred);
209 }
210}
211
212
213
214
215
216struct cred *cred_alloc_blank(void)
217{
218 struct cred *new;
219
220 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
221 if (!new)
222 return NULL;
223
224#ifdef CONFIG_KEYS
225 new->tgcred = kzalloc(sizeof(*new->tgcred), GFP_KERNEL);
226 if (!new->tgcred) {
227 kfree(new);
228 return NULL;
229 }
230 atomic_set(&new->tgcred->usage, 1);
231#endif
232
233 atomic_set(&new->usage, 1);
234
235 if (security_cred_alloc_blank(new, GFP_KERNEL) < 0)
236 goto error;
237
238#ifdef CONFIG_DEBUG_CREDENTIALS
239 new->magic = CRED_MAGIC;
240#endif
241 return new;
242
243error:
244 abort_creds(new);
245 return NULL;
246}
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262struct cred *prepare_creds(void)
263{
264 struct task_struct *task = current;
265 const struct cred *old;
266 struct cred *new;
267
268 validate_process_creds();
269
270 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
271 if (!new)
272 return NULL;
273
274 kdebug("prepare_creds() alloc %p", new);
275
276 old = task->cred;
277 memcpy(new, old, sizeof(struct cred));
278
279 atomic_set(&new->usage, 1);
280 set_cred_subscribers(new, 0);
281 get_group_info(new->group_info);
282 get_uid(new->user);
283
284#ifdef CONFIG_KEYS
285 key_get(new->thread_keyring);
286 key_get(new->request_key_auth);
287 atomic_inc(&new->tgcred->usage);
288#endif
289
290#ifdef CONFIG_SECURITY
291 new->security = NULL;
292#endif
293
294 if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
295 goto error;
296 validate_creds(new);
297 return new;
298
299error:
300 abort_creds(new);
301 return NULL;
302}
303EXPORT_SYMBOL(prepare_creds);
304
305
306
307
308
309struct cred *prepare_exec_creds(void)
310{
311 struct thread_group_cred *tgcred = NULL;
312 struct cred *new;
313
314#ifdef CONFIG_KEYS
315 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
316 if (!tgcred)
317 return NULL;
318#endif
319
320 new = prepare_creds();
321 if (!new) {
322 kfree(tgcred);
323 return new;
324 }
325
326#ifdef CONFIG_KEYS
327
328 key_put(new->thread_keyring);
329 new->thread_keyring = NULL;
330
331
332
333 memcpy(tgcred, new->tgcred, sizeof(struct thread_group_cred));
334
335 atomic_set(&tgcred->usage, 1);
336 spin_lock_init(&tgcred->lock);
337
338
339 key_get(tgcred->session_keyring);
340 tgcred->process_keyring = NULL;
341
342 release_tgcred(new);
343 new->tgcred = tgcred;
344#endif
345
346 return new;
347}
348
349
350
351
352struct cred *prepare_usermodehelper_creds(void)
353{
354#ifdef CONFIG_KEYS
355 struct thread_group_cred *tgcred = NULL;
356#endif
357 struct cred *new;
358
359#ifdef CONFIG_KEYS
360 tgcred = kzalloc(sizeof(*new->tgcred), GFP_ATOMIC);
361 if (!tgcred)
362 return NULL;
363#endif
364
365 new = kmem_cache_alloc(cred_jar, GFP_ATOMIC);
366 if (!new)
367 return NULL;
368
369 kdebug("prepare_usermodehelper_creds() alloc %p", new);
370
371 memcpy(new, &init_cred, sizeof(struct cred));
372
373 atomic_set(&new->usage, 1);
374 set_cred_subscribers(new, 0);
375 get_group_info(new->group_info);
376 get_uid(new->user);
377
378#ifdef CONFIG_KEYS
379 new->thread_keyring = NULL;
380 new->request_key_auth = NULL;
381 new->jit_keyring = KEY_REQKEY_DEFL_DEFAULT;
382
383 atomic_set(&tgcred->usage, 1);
384 spin_lock_init(&tgcred->lock);
385 new->tgcred = tgcred;
386#endif
387
388#ifdef CONFIG_SECURITY
389 new->security = NULL;
390#endif
391 if (security_prepare_creds(new, &init_cred, GFP_ATOMIC) < 0)
392 goto error;
393 validate_creds(new);
394
395 BUG_ON(atomic_read(&new->usage) != 1);
396 return new;
397
398error:
399 put_cred(new);
400 return NULL;
401}
402
403
404
405
406
407
408
409
410
411
412int copy_creds(struct task_struct *p, unsigned long clone_flags)
413{
414#ifdef CONFIG_KEYS
415 struct thread_group_cred *tgcred;
416#endif
417 struct cred *new;
418 int ret;
419
420 mutex_init(&p->cred_guard_mutex);
421
422 if (
423#ifdef CONFIG_KEYS
424 !p->cred->thread_keyring &&
425#endif
426 clone_flags & CLONE_THREAD
427 ) {
428 p->real_cred = get_cred(p->cred);
429 get_cred(p->cred);
430 alter_cred_subscribers(p->cred, 2);
431 kdebug("share_creds(%p{%d,%d})",
432 p->cred, atomic_read(&p->cred->usage),
433 read_cred_subscribers(p->cred));
434 atomic_inc(&p->cred->user->processes);
435 return 0;
436 }
437
438 new = prepare_creds();
439 if (!new)
440 return -ENOMEM;
441
442 if (clone_flags & CLONE_NEWUSER) {
443 ret = create_user_ns(new);
444 if (ret < 0)
445 goto error_put;
446 }
447
448#ifdef CONFIG_KEYS
449
450
451 if (new->thread_keyring) {
452 key_put(new->thread_keyring);
453 new->thread_keyring = NULL;
454 if (clone_flags & CLONE_THREAD)
455 install_thread_keyring_to_cred(new);
456 }
457
458
459
460
461 if (!(clone_flags & CLONE_THREAD)) {
462 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
463 if (!tgcred) {
464 ret = -ENOMEM;
465 goto error_put;
466 }
467 atomic_set(&tgcred->usage, 1);
468 spin_lock_init(&tgcred->lock);
469 tgcred->process_keyring = NULL;
470 tgcred->session_keyring = key_get(new->tgcred->session_keyring);
471
472 release_tgcred(new);
473 new->tgcred = tgcred;
474 }
475#endif
476
477 atomic_inc(&new->user->processes);
478 p->cred = p->real_cred = get_cred(new);
479 alter_cred_subscribers(new, 2);
480 validate_creds(new);
481 return 0;
482
483error_put:
484 put_cred(new);
485 return ret;
486}
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502int commit_creds(struct cred *new)
503{
504 struct task_struct *task = current;
505 const struct cred *old = task->real_cred;
506
507 kdebug("commit_creds(%p{%d,%d})", new,
508 atomic_read(&new->usage),
509 read_cred_subscribers(new));
510
511 BUG_ON(task->cred != old);
512#ifdef CONFIG_DEBUG_CREDENTIALS
513 BUG_ON(read_cred_subscribers(old) < 2);
514 validate_creds(old);
515 validate_creds(new);
516#endif
517 BUG_ON(atomic_read(&new->usage) < 1);
518
519 security_commit_creds(new, old);
520
521 get_cred(new);
522
523
524 if (old->euid != new->euid ||
525 old->egid != new->egid ||
526 old->fsuid != new->fsuid ||
527 old->fsgid != new->fsgid ||
528 !cap_issubset(new->cap_permitted, old->cap_permitted)) {
529 if (task->mm)
530 set_dumpable(task->mm, suid_dumpable);
531 task->pdeath_signal = 0;
532 smp_wmb();
533 }
534
535
536 if (new->fsuid != old->fsuid)
537 key_fsuid_changed(task);
538 if (new->fsgid != old->fsgid)
539 key_fsgid_changed(task);
540
541
542
543
544
545
546
547 alter_cred_subscribers(new, 2);
548 if (new->user != old->user)
549 atomic_inc(&new->user->processes);
550 rcu_assign_pointer(task->real_cred, new);
551 rcu_assign_pointer(task->cred, new);
552 if (new->user != old->user)
553 atomic_dec(&old->user->processes);
554 alter_cred_subscribers(old, -2);
555
556 sched_switch_user(task);
557
558
559 if (new->uid != old->uid ||
560 new->euid != old->euid ||
561 new->suid != old->suid ||
562 new->fsuid != old->fsuid)
563 proc_id_connector(task, PROC_EVENT_UID);
564
565 if (new->gid != old->gid ||
566 new->egid != old->egid ||
567 new->sgid != old->sgid ||
568 new->fsgid != old->fsgid)
569 proc_id_connector(task, PROC_EVENT_GID);
570
571
572 put_cred(old);
573 put_cred(old);
574 return 0;
575}
576EXPORT_SYMBOL(commit_creds);
577
578
579
580
581
582
583
584
585void abort_creds(struct cred *new)
586{
587 kdebug("abort_creds(%p{%d,%d})", new,
588 atomic_read(&new->usage),
589 read_cred_subscribers(new));
590
591#ifdef CONFIG_DEBUG_CREDENTIALS
592 BUG_ON(read_cred_subscribers(new) != 0);
593#endif
594 BUG_ON(atomic_read(&new->usage) < 1);
595 put_cred(new);
596}
597EXPORT_SYMBOL(abort_creds);
598
599
600
601
602
603
604
605
606const struct cred *override_creds(const struct cred *new)
607{
608 const struct cred *old = current->cred;
609
610 kdebug("override_creds(%p{%d,%d})", new,
611 atomic_read(&new->usage),
612 read_cred_subscribers(new));
613
614 validate_creds(old);
615 validate_creds(new);
616 get_cred(new);
617 alter_cred_subscribers(new, 1);
618 rcu_assign_pointer(current->cred, new);
619 alter_cred_subscribers(old, -1);
620
621 kdebug("override_creds() = %p{%d,%d}", old,
622 atomic_read(&old->usage),
623 read_cred_subscribers(old));
624 return old;
625}
626EXPORT_SYMBOL(override_creds);
627
628
629
630
631
632
633
634
635void revert_creds(const struct cred *old)
636{
637 const struct cred *override = current->cred;
638
639 kdebug("revert_creds(%p{%d,%d})", old,
640 atomic_read(&old->usage),
641 read_cred_subscribers(old));
642
643 validate_creds(old);
644 validate_creds(override);
645 alter_cred_subscribers(old, 1);
646 rcu_assign_pointer(current->cred, old);
647 alter_cred_subscribers(override, -1);
648 put_cred(override);
649}
650EXPORT_SYMBOL(revert_creds);
651
652
653
654
655void __init cred_init(void)
656{
657
658 cred_jar = kmem_cache_create("cred_jar", sizeof(struct cred),
659 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
660}
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680struct cred *prepare_kernel_cred(struct task_struct *daemon)
681{
682 const struct cred *old;
683 struct cred *new;
684
685 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
686 if (!new)
687 return NULL;
688
689 kdebug("prepare_kernel_cred() alloc %p", new);
690
691 if (daemon)
692 old = get_task_cred(daemon);
693 else
694 old = get_cred(&init_cred);
695
696 validate_creds(old);
697
698 *new = *old;
699 get_uid(new->user);
700 get_group_info(new->group_info);
701
702#ifdef CONFIG_KEYS
703 atomic_inc(&init_tgcred.usage);
704 new->tgcred = &init_tgcred;
705 new->request_key_auth = NULL;
706 new->thread_keyring = NULL;
707 new->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
708#endif
709
710#ifdef CONFIG_SECURITY
711 new->security = NULL;
712#endif
713 if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
714 goto error;
715
716 atomic_set(&new->usage, 1);
717 set_cred_subscribers(new, 0);
718 put_cred(old);
719 validate_creds(new);
720 return new;
721
722error:
723 put_cred(new);
724 put_cred(old);
725 return NULL;
726}
727EXPORT_SYMBOL(prepare_kernel_cred);
728
729
730
731
732
733
734
735
736
737int set_security_override(struct cred *new, u32 secid)
738{
739 return security_kernel_act_as(new, secid);
740}
741EXPORT_SYMBOL(set_security_override);
742
743
744
745
746
747
748
749
750
751
752
753int set_security_override_from_ctx(struct cred *new, const char *secctx)
754{
755 u32 secid;
756 int ret;
757
758 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
759 if (ret < 0)
760 return ret;
761
762 return set_security_override(new, secid);
763}
764EXPORT_SYMBOL(set_security_override_from_ctx);
765
766
767
768
769
770
771
772
773
774
775int set_create_files_as(struct cred *new, struct inode *inode)
776{
777 new->fsuid = inode->i_uid;
778 new->fsgid = inode->i_gid;
779 return security_kernel_create_files_as(new, inode);
780}
781EXPORT_SYMBOL(set_create_files_as);
782
783#ifdef CONFIG_DEBUG_CREDENTIALS
784
785bool creds_are_invalid(const struct cred *cred)
786{
787 if (cred->magic != CRED_MAGIC)
788 return true;
789 if (atomic_read(&cred->usage) < atomic_read(&cred->subscribers))
790 return true;
791#ifdef CONFIG_SECURITY_SELINUX
792 if (selinux_is_enabled()) {
793 if ((unsigned long) cred->security < PAGE_SIZE)
794 return true;
795 if ((*(u32 *)cred->security & 0xffffff00) ==
796 (POISON_FREE << 24 | POISON_FREE << 16 | POISON_FREE << 8))
797 return true;
798 }
799#endif
800 return false;
801}
802EXPORT_SYMBOL(creds_are_invalid);
803
804
805
806
807static void dump_invalid_creds(const struct cred *cred, const char *label,
808 const struct task_struct *tsk)
809{
810 printk(KERN_ERR "CRED: %s credentials: %p %s%s%s\n",
811 label, cred,
812 cred == &init_cred ? "[init]" : "",
813 cred == tsk->real_cred ? "[real]" : "",
814 cred == tsk->cred ? "[eff]" : "");
815 printk(KERN_ERR "CRED: ->magic=%x, put_addr=%p\n",
816 cred->magic, cred->put_addr);
817 printk(KERN_ERR "CRED: ->usage=%d, subscr=%d\n",
818 atomic_read(&cred->usage),
819 read_cred_subscribers(cred));
820 printk(KERN_ERR "CRED: ->*uid = { %d,%d,%d,%d }\n",
821 cred->uid, cred->euid, cred->suid, cred->fsuid);
822 printk(KERN_ERR "CRED: ->*gid = { %d,%d,%d,%d }\n",
823 cred->gid, cred->egid, cred->sgid, cred->fsgid);
824#ifdef CONFIG_SECURITY
825 printk(KERN_ERR "CRED: ->security is %p\n", cred->security);
826 if ((unsigned long) cred->security >= PAGE_SIZE &&
827 (((unsigned long) cred->security & 0xffffff00) !=
828 (POISON_FREE << 24 | POISON_FREE << 16 | POISON_FREE << 8)))
829 printk(KERN_ERR "CRED: ->security {%x, %x}\n",
830 ((u32*)cred->security)[0],
831 ((u32*)cred->security)[1]);
832#endif
833}
834
835
836
837
838void __invalid_creds(const struct cred *cred, const char *file, unsigned line)
839{
840 printk(KERN_ERR "CRED: Invalid credentials\n");
841 printk(KERN_ERR "CRED: At %s:%u\n", file, line);
842 dump_invalid_creds(cred, "Specified", current);
843 BUG();
844}
845EXPORT_SYMBOL(__invalid_creds);
846
847
848
849
850void __validate_process_creds(struct task_struct *tsk,
851 const char *file, unsigned line)
852{
853 if (tsk->cred == tsk->real_cred) {
854 if (unlikely(read_cred_subscribers(tsk->cred) < 2 ||
855 creds_are_invalid(tsk->cred)))
856 goto invalid_creds;
857 } else {
858 if (unlikely(read_cred_subscribers(tsk->real_cred) < 1 ||
859 read_cred_subscribers(tsk->cred) < 1 ||
860 creds_are_invalid(tsk->real_cred) ||
861 creds_are_invalid(tsk->cred)))
862 goto invalid_creds;
863 }
864 return;
865
866invalid_creds:
867 printk(KERN_ERR "CRED: Invalid process credentials\n");
868 printk(KERN_ERR "CRED: At %s:%u\n", file, line);
869
870 dump_invalid_creds(tsk->real_cred, "Real", tsk);
871 if (tsk->cred != tsk->real_cred)
872 dump_invalid_creds(tsk->cred, "Effective", tsk);
873 else
874 printk(KERN_ERR "CRED: Effective creds == Real creds\n");
875 BUG();
876}
877EXPORT_SYMBOL(__validate_process_creds);
878
879
880
881
882void validate_creds_for_do_exit(struct task_struct *tsk)
883{
884 kdebug("validate_creds_for_do_exit(%p,%p{%d,%d})",
885 tsk->real_cred, tsk->cred,
886 atomic_read(&tsk->cred->usage),
887 read_cred_subscribers(tsk->cred));
888
889 __validate_process_creds(tsk, __FILE__, __LINE__);
890}
891
892#endif
893