1
2
3
4
5
6
7
8
9
10
11
12#ifndef _LINUX_CRED_H
13#define _LINUX_CRED_H
14
15#include <linux/capability.h>
16#include <linux/init.h>
17#include <linux/key.h>
18#include <linux/selinux.h>
19#include <asm/atomic.h>
20
21struct user_struct;
22struct cred;
23struct inode;
24
25
26
27
28#define NGROUPS_SMALL 32
29#define NGROUPS_PER_BLOCK ((unsigned int)(PAGE_SIZE / sizeof(gid_t)))
30
31struct group_info {
32 atomic_t usage;
33 int ngroups;
34 int nblocks;
35 gid_t small_block[NGROUPS_SMALL];
36 gid_t *blocks[0];
37};
38
39
40
41
42
43
44
45
46
47
48static inline struct group_info *get_group_info(struct group_info *gi)
49{
50 atomic_inc(&gi->usage);
51 return gi;
52}
53
54
55
56
57
58#define put_group_info(group_info) \
59do { \
60 if (atomic_dec_and_test(&(group_info)->usage)) \
61 groups_free(group_info); \
62} while (0)
63
64extern struct group_info *groups_alloc(int);
65extern struct group_info init_groups;
66extern void groups_free(struct group_info *);
67extern int set_current_groups(struct group_info *);
68extern int set_groups(struct cred *, struct group_info *);
69extern int groups_search(const struct group_info *, gid_t);
70
71
72#define GROUP_AT(gi, i) \
73 ((gi)->blocks[(i) / NGROUPS_PER_BLOCK][(i) % NGROUPS_PER_BLOCK])
74
75extern int in_group_p(gid_t);
76extern int in_egroup_p(gid_t);
77
78
79
80
81
82#ifdef CONFIG_KEYS
83struct thread_group_cred {
84 atomic_t usage;
85 pid_t tgid;
86 spinlock_t lock;
87 struct key __rcu *session_keyring;
88 struct key *process_keyring;
89 struct rcu_head rcu;
90};
91#endif
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116struct cred {
117 atomic_t usage;
118#ifdef CONFIG_DEBUG_CREDENTIALS
119 atomic_t subscribers;
120 void *put_addr;
121 unsigned magic;
122#define CRED_MAGIC 0x43736564
123#define CRED_MAGIC_DEAD 0x44656144
124#endif
125 uid_t uid;
126 gid_t gid;
127 uid_t suid;
128 gid_t sgid;
129 uid_t euid;
130 gid_t egid;
131 uid_t fsuid;
132 gid_t fsgid;
133 unsigned securebits;
134 kernel_cap_t cap_inheritable;
135 kernel_cap_t cap_permitted;
136 kernel_cap_t cap_effective;
137 kernel_cap_t cap_bset;
138#ifdef CONFIG_KEYS
139 unsigned char jit_keyring;
140
141 struct key *thread_keyring;
142 struct key *request_key_auth;
143 struct thread_group_cred *tgcred;
144#endif
145#ifdef CONFIG_SECURITY
146 void *security;
147#endif
148 struct user_struct *user;
149 struct group_info *group_info;
150 struct rcu_head rcu;
151};
152
153extern void __put_cred(struct cred *);
154extern void exit_creds(struct task_struct *);
155extern int copy_creds(struct task_struct *, unsigned long);
156extern const struct cred *get_task_cred(struct task_struct *);
157extern struct cred *cred_alloc_blank(void);
158extern struct cred *prepare_creds(void);
159extern struct cred *prepare_exec_creds(void);
160extern int commit_creds(struct cred *);
161extern void abort_creds(struct cred *);
162extern const struct cred *override_creds(const struct cred *);
163extern void revert_creds(const struct cred *);
164extern struct cred *prepare_kernel_cred(struct task_struct *);
165extern int change_create_files_as(struct cred *, struct inode *);
166extern int set_security_override(struct cred *, u32);
167extern int set_security_override_from_ctx(struct cred *, const char *);
168extern int set_create_files_as(struct cred *, struct inode *);
169extern void __init cred_init(void);
170
171
172
173
174#ifdef CONFIG_DEBUG_CREDENTIALS
175extern void __invalid_creds(const struct cred *, const char *, unsigned);
176extern void __validate_process_creds(struct task_struct *,
177 const char *, unsigned);
178
179extern bool creds_are_invalid(const struct cred *cred);
180
181static inline void __validate_creds(const struct cred *cred,
182 const char *file, unsigned line)
183{
184 if (unlikely(creds_are_invalid(cred)))
185 __invalid_creds(cred, file, line);
186}
187
188#define validate_creds(cred) \
189do { \
190 __validate_creds((cred), __FILE__, __LINE__); \
191} while(0)
192
193#define validate_process_creds() \
194do { \
195 __validate_process_creds(current, __FILE__, __LINE__); \
196} while(0)
197
198extern void validate_creds_for_do_exit(struct task_struct *);
199#else
200static inline void validate_creds(const struct cred *cred)
201{
202}
203static inline void validate_creds_for_do_exit(struct task_struct *tsk)
204{
205}
206static inline void validate_process_creds(void)
207{
208}
209#endif
210
211
212
213
214
215
216
217
218static inline struct cred *get_new_cred(struct cred *cred)
219{
220 atomic_inc(&cred->usage);
221 return cred;
222}
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237static inline const struct cred *get_cred(const struct cred *cred)
238{
239 struct cred *nonconst_cred = (struct cred *) cred;
240 validate_creds(cred);
241 return get_new_cred(nonconst_cred);
242}
243
244
245
246
247
248
249
250
251
252
253
254
255static inline void put_cred(const struct cred *_cred)
256{
257 struct cred *cred = (struct cred *) _cred;
258
259 validate_creds(cred);
260 if (atomic_dec_and_test(&(cred)->usage))
261 __put_cred(cred);
262}
263
264
265
266
267
268
269#define current_cred() \
270 (current->cred)
271
272
273
274
275
276
277
278
279
280
281
282#define __task_cred(task) \
283 ({ \
284 const struct task_struct *__t = (task); \
285 rcu_dereference_check(__t->real_cred, \
286 rcu_read_lock_held() || \
287 task_is_dead(__t)); \
288 })
289
290
291
292
293
294
295
296
297#define get_current_cred() \
298 (get_cred(current_cred()))
299
300
301
302
303
304
305
306#define get_current_user() \
307({ \
308 struct user_struct *__u; \
309 struct cred *__cred; \
310 __cred = (struct cred *) current_cred(); \
311 __u = get_uid(__cred->user); \
312 __u; \
313})
314
315
316
317
318
319
320
321#define get_current_groups() \
322({ \
323 struct group_info *__groups; \
324 struct cred *__cred; \
325 __cred = (struct cred *) current_cred(); \
326 __groups = get_group_info(__cred->group_info); \
327 __groups; \
328})
329
330#define task_cred_xxx(task, xxx) \
331({ \
332 __typeof__(((struct cred *)NULL)->xxx) ___val; \
333 rcu_read_lock(); \
334 ___val = __task_cred((task))->xxx; \
335 rcu_read_unlock(); \
336 ___val; \
337})
338
339#define task_uid(task) (task_cred_xxx((task), uid))
340#define task_euid(task) (task_cred_xxx((task), euid))
341
342#define current_cred_xxx(xxx) \
343({ \
344 current->cred->xxx; \
345})
346
347#define current_uid() (current_cred_xxx(uid))
348#define current_gid() (current_cred_xxx(gid))
349#define current_euid() (current_cred_xxx(euid))
350#define current_egid() (current_cred_xxx(egid))
351#define current_suid() (current_cred_xxx(suid))
352#define current_sgid() (current_cred_xxx(sgid))
353#define current_fsuid() (current_cred_xxx(fsuid))
354#define current_fsgid() (current_cred_xxx(fsgid))
355#define current_cap() (current_cred_xxx(cap_effective))
356#define current_user() (current_cred_xxx(user))
357#define current_user_ns() (current_cred_xxx(user)->user_ns)
358#define current_security() (current_cred_xxx(security))
359
360#define current_uid_gid(_uid, _gid) \
361do { \
362 const struct cred *__cred; \
363 __cred = current_cred(); \
364 *(_uid) = __cred->uid; \
365 *(_gid) = __cred->gid; \
366} while(0)
367
368#define current_euid_egid(_euid, _egid) \
369do { \
370 const struct cred *__cred; \
371 __cred = current_cred(); \
372 *(_euid) = __cred->euid; \
373 *(_egid) = __cred->egid; \
374} while(0)
375
376#define current_fsuid_fsgid(_fsuid, _fsgid) \
377do { \
378 const struct cred *__cred; \
379 __cred = current_cred(); \
380 *(_fsuid) = __cred->fsuid; \
381 *(_fsgid) = __cred->fsgid; \
382} while(0)
383
384#endif
385