1
2
3
4
5
6
7
8
9
10
11
12#ifndef _LINUX_CRED_H
13#define _LINUX_CRED_H
14
15#include <linux/capability.h>
16#include <linux/init.h>
17#include <linux/key.h>
18#include <linux/selinux.h>
19#include <linux/atomic.h>
20#include <linux/uidgid.h>
21
22struct user_struct;
23struct cred;
24struct inode;
25
26
27
28
29#define NGROUPS_SMALL 32
30#define NGROUPS_PER_BLOCK ((unsigned int)(PAGE_SIZE / sizeof(kgid_t)))
31
32struct group_info {
33 atomic_t usage;
34 int ngroups;
35 int nblocks;
36 kgid_t small_block[NGROUPS_SMALL];
37 kgid_t *blocks[0];
38};
39
40
41
42
43
44
45
46
47
48
49static inline struct group_info *get_group_info(struct group_info *gi)
50{
51 atomic_inc(&gi->usage);
52 return gi;
53}
54
55
56
57
58
59#define put_group_info(group_info) \
60do { \
61 if (atomic_dec_and_test(&(group_info)->usage)) \
62 groups_free(group_info); \
63} while (0)
64
65extern struct group_info *groups_alloc(int);
66extern struct group_info init_groups;
67extern void groups_free(struct group_info *);
68extern int set_current_groups(struct group_info *);
69extern void set_groups(struct cred *, struct group_info *);
70extern int groups_search(const struct group_info *, kgid_t);
71
72
73#define GROUP_AT(gi, i) \
74 ((gi)->blocks[(i) / NGROUPS_PER_BLOCK][(i) % NGROUPS_PER_BLOCK])
75
76extern int in_group_p(kgid_t);
77extern int in_egroup_p(kgid_t);
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102struct cred {
103 atomic_t usage;
104#ifdef CONFIG_DEBUG_CREDENTIALS
105 atomic_t subscribers;
106 void *put_addr;
107 unsigned magic;
108#define CRED_MAGIC 0x43736564
109#define CRED_MAGIC_DEAD 0x44656144
110#endif
111 kuid_t uid;
112 kgid_t gid;
113 kuid_t suid;
114 kgid_t sgid;
115 kuid_t euid;
116 kgid_t egid;
117 kuid_t fsuid;
118 kgid_t fsgid;
119 unsigned securebits;
120 kernel_cap_t cap_inheritable;
121 kernel_cap_t cap_permitted;
122 kernel_cap_t cap_effective;
123 kernel_cap_t cap_bset;
124#ifdef CONFIG_KEYS
125 unsigned char jit_keyring;
126
127 struct key __rcu *session_keyring;
128 struct key *process_keyring;
129 struct key *thread_keyring;
130 struct key *request_key_auth;
131#endif
132#ifdef CONFIG_SECURITY
133 void *security;
134#endif
135 struct user_struct *user;
136 struct user_namespace *user_ns;
137 struct group_info *group_info;
138 struct rcu_head rcu;
139};
140
141extern void __put_cred(struct cred *);
142extern void exit_creds(struct task_struct *);
143extern int copy_creds(struct task_struct *, unsigned long);
144extern const struct cred *get_task_cred(struct task_struct *);
145extern struct cred *cred_alloc_blank(void);
146extern struct cred *prepare_creds(void);
147extern struct cred *prepare_exec_creds(void);
148extern int commit_creds(struct cred *);
149extern void abort_creds(struct cred *);
150extern const struct cred *override_creds(const struct cred *);
151extern void revert_creds(const struct cred *);
152extern struct cred *prepare_kernel_cred(struct task_struct *);
153extern int change_create_files_as(struct cred *, struct inode *);
154extern int set_security_override(struct cred *, u32);
155extern int set_security_override_from_ctx(struct cred *, const char *);
156extern int set_create_files_as(struct cred *, struct inode *);
157extern void __init cred_init(void);
158
159
160
161
162#ifdef CONFIG_DEBUG_CREDENTIALS
163extern void __invalid_creds(const struct cred *, const char *, unsigned);
164extern void __validate_process_creds(struct task_struct *,
165 const char *, unsigned);
166
167extern bool creds_are_invalid(const struct cred *cred);
168
169static inline void __validate_creds(const struct cred *cred,
170 const char *file, unsigned line)
171{
172 if (unlikely(creds_are_invalid(cred)))
173 __invalid_creds(cred, file, line);
174}
175
176#define validate_creds(cred) \
177do { \
178 __validate_creds((cred), __FILE__, __LINE__); \
179} while(0)
180
181#define validate_process_creds() \
182do { \
183 __validate_process_creds(current, __FILE__, __LINE__); \
184} while(0)
185
186extern void validate_creds_for_do_exit(struct task_struct *);
187#else
188static inline void validate_creds(const struct cred *cred)
189{
190}
191static inline void validate_creds_for_do_exit(struct task_struct *tsk)
192{
193}
194static inline void validate_process_creds(void)
195{
196}
197#endif
198
199
200
201
202
203
204
205
206static inline struct cred *get_new_cred(struct cred *cred)
207{
208 atomic_inc(&cred->usage);
209 return cred;
210}
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225static inline const struct cred *get_cred(const struct cred *cred)
226{
227 struct cred *nonconst_cred = (struct cred *) cred;
228 validate_creds(cred);
229 return get_new_cred(nonconst_cred);
230}
231
232
233
234
235
236
237
238
239
240
241
242
243static inline void put_cred(const struct cred *_cred)
244{
245 struct cred *cred = (struct cred *) _cred;
246
247 validate_creds(cred);
248 if (atomic_dec_and_test(&(cred)->usage))
249 __put_cred(cred);
250}
251
252
253
254
255
256
257
258#define current_cred() \
259 rcu_dereference_protected(current->cred, 1)
260
261
262
263
264
265
266
267#define current_real_cred() \
268 rcu_dereference_protected(current->real_cred, 1)
269
270
271
272
273
274
275
276
277
278
279
280#define __task_cred(task) \
281 rcu_dereference((task)->real_cred)
282
283
284
285
286
287
288
289
290#define get_current_cred() \
291 (get_cred(current_cred()))
292
293
294
295
296
297
298
299#define get_current_user() \
300({ \
301 struct user_struct *__u; \
302 const struct cred *__cred; \
303 __cred = current_cred(); \
304 __u = get_uid(__cred->user); \
305 __u; \
306})
307
308
309
310
311
312
313
314#define get_current_groups() \
315({ \
316 struct group_info *__groups; \
317 const struct cred *__cred; \
318 __cred = current_cred(); \
319 __groups = get_group_info(__cred->group_info); \
320 __groups; \
321})
322
323#define task_cred_xxx(task, xxx) \
324({ \
325 __typeof__(((struct cred *)NULL)->xxx) ___val; \
326 rcu_read_lock(); \
327 ___val = __task_cred((task))->xxx; \
328 rcu_read_unlock(); \
329 ___val; \
330})
331
332#define task_uid(task) (task_cred_xxx((task), uid))
333#define task_euid(task) (task_cred_xxx((task), euid))
334
335#define current_cred_xxx(xxx) \
336({ \
337 current_cred()->xxx; \
338})
339
340#define current_uid() (current_cred_xxx(uid))
341#define current_gid() (current_cred_xxx(gid))
342#define current_euid() (current_cred_xxx(euid))
343#define current_egid() (current_cred_xxx(egid))
344#define current_suid() (current_cred_xxx(suid))
345#define current_sgid() (current_cred_xxx(sgid))
346#define current_fsuid() (current_cred_xxx(fsuid))
347#define current_fsgid() (current_cred_xxx(fsgid))
348#define current_cap() (current_cred_xxx(cap_effective))
349#define current_user() (current_cred_xxx(user))
350#define current_security() (current_cred_xxx(security))
351
352extern struct user_namespace init_user_ns;
353#ifdef CONFIG_USER_NS
354#define current_user_ns() (current_cred_xxx(user_ns))
355#else
356#define current_user_ns() (&init_user_ns)
357#endif
358
359
360#define current_uid_gid(_uid, _gid) \
361do { \
362 const struct cred *__cred; \
363 __cred = current_cred(); \
364 *(_uid) = __cred->uid; \
365 *(_gid) = __cred->gid; \
366} while(0)
367
368#define current_euid_egid(_euid, _egid) \
369do { \
370 const struct cred *__cred; \
371 __cred = current_cred(); \
372 *(_euid) = __cred->euid; \
373 *(_egid) = __cred->egid; \
374} while(0)
375
376#define current_fsuid_fsgid(_fsuid, _fsgid) \
377do { \
378 const struct cred *__cred; \
379 __cred = current_cred(); \
380 *(_fsuid) = __cred->fsuid; \
381 *(_fsgid) = __cred->fsgid; \
382} while(0)
383
384#endif
385