1
2
3
4
5
6
7
8
9
10
11
12#ifndef _LINUX_CRED_H
13#define _LINUX_CRED_H
14
15#include <linux/capability.h>
16#include <linux/init.h>
17#include <linux/key.h>
18#include <linux/selinux.h>
19#include <linux/atomic.h>
20
21struct user_struct;
22struct cred;
23struct inode;
24
25
26
27
28#define NGROUPS_SMALL 32
29#define NGROUPS_PER_BLOCK ((unsigned int)(PAGE_SIZE / sizeof(gid_t)))
30
31struct group_info {
32 atomic_t usage;
33 int ngroups;
34 int nblocks;
35 gid_t small_block[NGROUPS_SMALL];
36 gid_t *blocks[0];
37};
38
39
40
41
42
43
44
45
46
47
48static inline struct group_info *get_group_info(struct group_info *gi)
49{
50 atomic_inc(&gi->usage);
51 return gi;
52}
53
54
55
56
57
58#define put_group_info(group_info) \
59do { \
60 if (atomic_dec_and_test(&(group_info)->usage)) \
61 groups_free(group_info); \
62} while (0)
63
64extern struct group_info *groups_alloc(int);
65extern struct group_info init_groups;
66extern void groups_free(struct group_info *);
67extern int set_current_groups(struct group_info *);
68extern int set_groups(struct cred *, struct group_info *);
69extern int groups_search(const struct group_info *, gid_t);
70
71
72#define GROUP_AT(gi, i) \
73 ((gi)->blocks[(i) / NGROUPS_PER_BLOCK][(i) % NGROUPS_PER_BLOCK])
74
75extern int in_group_p(gid_t);
76extern int in_egroup_p(gid_t);
77
78
79
80
81
82#ifdef CONFIG_KEYS
83struct thread_group_cred {
84 atomic_t usage;
85 pid_t tgid;
86 spinlock_t lock;
87 struct key __rcu *session_keyring;
88 struct key *process_keyring;
89 struct rcu_head rcu;
90};
91#endif
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116struct cred {
117 atomic_t usage;
118#ifdef CONFIG_DEBUG_CREDENTIALS
119 atomic_t subscribers;
120 void *put_addr;
121 unsigned magic;
122#define CRED_MAGIC 0x43736564
123#define CRED_MAGIC_DEAD 0x44656144
124#endif
125 uid_t uid;
126 gid_t gid;
127 uid_t suid;
128 gid_t sgid;
129 uid_t euid;
130 gid_t egid;
131 uid_t fsuid;
132 gid_t fsgid;
133 unsigned securebits;
134 kernel_cap_t cap_inheritable;
135 kernel_cap_t cap_permitted;
136 kernel_cap_t cap_effective;
137 kernel_cap_t cap_bset;
138#ifdef CONFIG_KEYS
139 unsigned char jit_keyring;
140
141 struct key *thread_keyring;
142 struct key *request_key_auth;
143 struct thread_group_cred *tgcred;
144#endif
145#ifdef CONFIG_SECURITY
146 void *security;
147#endif
148 struct user_struct *user;
149 struct user_namespace *user_ns;
150 struct group_info *group_info;
151 struct rcu_head rcu;
152};
153
154extern void __put_cred(struct cred *);
155extern void exit_creds(struct task_struct *);
156extern int copy_creds(struct task_struct *, unsigned long);
157extern const struct cred *get_task_cred(struct task_struct *);
158extern struct cred *cred_alloc_blank(void);
159extern struct cred *prepare_creds(void);
160extern struct cred *prepare_exec_creds(void);
161extern int commit_creds(struct cred *);
162extern void abort_creds(struct cred *);
163extern const struct cred *override_creds(const struct cred *);
164extern void revert_creds(const struct cred *);
165extern struct cred *prepare_kernel_cred(struct task_struct *);
166extern int change_create_files_as(struct cred *, struct inode *);
167extern int set_security_override(struct cred *, u32);
168extern int set_security_override_from_ctx(struct cred *, const char *);
169extern int set_create_files_as(struct cred *, struct inode *);
170extern void __init cred_init(void);
171
172
173
174
175#ifdef CONFIG_DEBUG_CREDENTIALS
176extern void __invalid_creds(const struct cred *, const char *, unsigned);
177extern void __validate_process_creds(struct task_struct *,
178 const char *, unsigned);
179
180extern bool creds_are_invalid(const struct cred *cred);
181
182static inline void __validate_creds(const struct cred *cred,
183 const char *file, unsigned line)
184{
185 if (unlikely(creds_are_invalid(cred)))
186 __invalid_creds(cred, file, line);
187}
188
189#define validate_creds(cred) \
190do { \
191 __validate_creds((cred), __FILE__, __LINE__); \
192} while(0)
193
194#define validate_process_creds() \
195do { \
196 __validate_process_creds(current, __FILE__, __LINE__); \
197} while(0)
198
199extern void validate_creds_for_do_exit(struct task_struct *);
200#else
201static inline void validate_creds(const struct cred *cred)
202{
203}
204static inline void validate_creds_for_do_exit(struct task_struct *tsk)
205{
206}
207static inline void validate_process_creds(void)
208{
209}
210#endif
211
212
213
214
215
216
217
218
219static inline struct cred *get_new_cred(struct cred *cred)
220{
221 atomic_inc(&cred->usage);
222 return cred;
223}
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238static inline const struct cred *get_cred(const struct cred *cred)
239{
240 struct cred *nonconst_cred = (struct cred *) cred;
241 validate_creds(cred);
242 return get_new_cred(nonconst_cred);
243}
244
245
246
247
248
249
250
251
252
253
254
255
256static inline void put_cred(const struct cred *_cred)
257{
258 struct cred *cred = (struct cred *) _cred;
259
260 validate_creds(cred);
261 if (atomic_dec_and_test(&(cred)->usage))
262 __put_cred(cred);
263}
264
265
266
267
268
269
270
271#define current_cred() \
272 rcu_dereference_protected(current->cred, 1)
273
274
275
276
277
278
279
280
281
282
283
284#define __task_cred(task) \
285 ({ \
286 const struct task_struct *__t = (task); \
287 rcu_dereference_check(__t->real_cred, \
288 task_is_dead(__t)); \
289 })
290
291
292
293
294
295
296
297
298#define get_current_cred() \
299 (get_cred(current_cred()))
300
301
302
303
304
305
306
307#define get_current_user() \
308({ \
309 struct user_struct *__u; \
310 const struct cred *__cred; \
311 __cred = current_cred(); \
312 __u = get_uid(__cred->user); \
313 __u; \
314})
315
316
317
318
319
320
321
322#define get_current_groups() \
323({ \
324 struct group_info *__groups; \
325 const struct cred *__cred; \
326 __cred = current_cred(); \
327 __groups = get_group_info(__cred->group_info); \
328 __groups; \
329})
330
331#define task_cred_xxx(task, xxx) \
332({ \
333 __typeof__(((struct cred *)NULL)->xxx) ___val; \
334 rcu_read_lock(); \
335 ___val = __task_cred((task))->xxx; \
336 rcu_read_unlock(); \
337 ___val; \
338})
339
340#define task_uid(task) (task_cred_xxx((task), uid))
341#define task_euid(task) (task_cred_xxx((task), euid))
342
343#define current_cred_xxx(xxx) \
344({ \
345 current_cred()->xxx; \
346})
347
348#define current_uid() (current_cred_xxx(uid))
349#define current_gid() (current_cred_xxx(gid))
350#define current_euid() (current_cred_xxx(euid))
351#define current_egid() (current_cred_xxx(egid))
352#define current_suid() (current_cred_xxx(suid))
353#define current_sgid() (current_cred_xxx(sgid))
354#define current_fsuid() (current_cred_xxx(fsuid))
355#define current_fsgid() (current_cred_xxx(fsgid))
356#define current_cap() (current_cred_xxx(cap_effective))
357#define current_user() (current_cred_xxx(user))
358#define current_security() (current_cred_xxx(security))
359
360#ifdef CONFIG_USER_NS
361#define current_user_ns() (current_cred_xxx(user_ns))
362#define task_user_ns(task) (task_cred_xxx((task), user_ns))
363#else
364extern struct user_namespace init_user_ns;
365#define current_user_ns() (&init_user_ns)
366#define task_user_ns(task) (&init_user_ns)
367#endif
368
369
370#define current_uid_gid(_uid, _gid) \
371do { \
372 const struct cred *__cred; \
373 __cred = current_cred(); \
374 *(_uid) = __cred->uid; \
375 *(_gid) = __cred->gid; \
376} while(0)
377
378#define current_euid_egid(_euid, _egid) \
379do { \
380 const struct cred *__cred; \
381 __cred = current_cred(); \
382 *(_euid) = __cred->euid; \
383 *(_egid) = __cred->egid; \
384} while(0)
385
386#define current_fsuid_fsgid(_fsuid, _fsgid) \
387do { \
388 const struct cred *__cred; \
389 __cred = current_cred(); \
390 *(_fsuid) = __cred->fsuid; \
391 *(_fsgid) = __cred->fsgid; \
392} while(0)
393
394#endif
395