1 /* SPDX-License-Identifier: GPL-2.0-or-later */
2 /* Credentials management - see Documentation/security/credentials.rst
3  *
4  * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved.
5  * Written by David Howells (dhowells@redhat.com)
6  */
7 
8 #ifndef _LINUX_CRED_H
9 #define _LINUX_CRED_H
10 
11 #include <linux/capability.h>
12 #include <linux/init.h>
13 #include <linux/key.h>
14 #include <linux/atomic.h>
15 #include <linux/uidgid.h>
16 #include <linux/sched.h>
17 #include <linux/sched/user.h>
18 
19 struct cred;
20 struct inode;
21 
22 /*
23  * COW Supplementary groups list
24  */
25 struct group_info {
26 	atomic_t	usage;
27 	int		ngroups;
28 	kgid_t		gid[];
29 } __randomize_layout;
30 
31 /**
32  * get_group_info - Get a reference to a group info structure
33  * @group_info: The group info to reference
34  *
35  * This gets a reference to a set of supplementary groups.
36  *
37  * If the caller is accessing a task's credentials, they must hold the RCU read
38  * lock when reading.
39  */
get_group_info(struct group_info * gi)40 static inline struct group_info *get_group_info(struct group_info *gi)
41 {
42 	atomic_inc(&gi->usage);
43 	return gi;
44 }
45 
46 /**
47  * put_group_info - Release a reference to a group info structure
48  * @group_info: The group info to release
49  */
50 #define put_group_info(group_info)			\
51 do {							\
52 	if (atomic_dec_and_test(&(group_info)->usage))	\
53 		groups_free(group_info);		\
54 } while (0)
55 
56 #ifdef CONFIG_MULTIUSER
57 extern struct group_info *groups_alloc(int);
58 extern void groups_free(struct group_info *);
59 
60 extern int in_group_p(kgid_t);
61 extern int in_egroup_p(kgid_t);
62 extern int groups_search(const struct group_info *, kgid_t);
63 
64 extern int set_current_groups(struct group_info *);
65 extern void set_groups(struct cred *, struct group_info *);
66 extern bool may_setgroups(void);
67 extern void groups_sort(struct group_info *);
68 #else
groups_free(struct group_info * group_info)69 static inline void groups_free(struct group_info *group_info)
70 {
71 }
72 
in_group_p(kgid_t grp)73 static inline int in_group_p(kgid_t grp)
74 {
75         return 1;
76 }
in_egroup_p(kgid_t grp)77 static inline int in_egroup_p(kgid_t grp)
78 {
79         return 1;
80 }
groups_search(const struct group_info * group_info,kgid_t grp)81 static inline int groups_search(const struct group_info *group_info, kgid_t grp)
82 {
83 	return 1;
84 }
85 #endif
86 
87 /*
88  * The security context of a task
89  *
90  * The parts of the context break down into two categories:
91  *
92  *  (1) The objective context of a task.  These parts are used when some other
93  *	task is attempting to affect this one.
94  *
95  *  (2) The subjective context.  These details are used when the task is acting
96  *	upon another object, be that a file, a task, a key or whatever.
97  *
98  * Note that some members of this structure belong to both categories - the
99  * LSM security pointer for instance.
100  *
101  * A task has two security pointers.  task->real_cred points to the objective
102  * context that defines that task's actual details.  The objective part of this
103  * context is used whenever that task is acted upon.
104  *
105  * task->cred points to the subjective context that defines the details of how
106  * that task is going to act upon another object.  This may be overridden
107  * temporarily to point to another security context, but normally points to the
108  * same context as task->real_cred.
109  */
110 struct cred {
111 	atomic_long_t	usage;
112 	kuid_t		uid;		/* real UID of the task */
113 	kgid_t		gid;		/* real GID of the task */
114 	kuid_t		suid;		/* saved UID of the task */
115 	kgid_t		sgid;		/* saved GID of the task */
116 	kuid_t		euid;		/* effective UID of the task */
117 	kgid_t		egid;		/* effective GID of the task */
118 	kuid_t		fsuid;		/* UID for VFS ops */
119 	kgid_t		fsgid;		/* GID for VFS ops */
120 	unsigned	securebits;	/* SUID-less security management */
121 	kernel_cap_t	cap_inheritable; /* caps our children can inherit */
122 	kernel_cap_t	cap_permitted;	/* caps we're permitted */
123 	kernel_cap_t	cap_effective;	/* caps we can actually use */
124 	kernel_cap_t	cap_bset;	/* capability bounding set */
125 	kernel_cap_t	cap_ambient;	/* Ambient capability set */
126 #ifdef CONFIG_KEYS
127 	unsigned char	jit_keyring;	/* default keyring to attach requested
128 					 * keys to */
129 	struct key	*session_keyring; /* keyring inherited over fork */
130 	struct key	*process_keyring; /* keyring private to this process */
131 	struct key	*thread_keyring; /* keyring private to this thread */
132 	struct key	*request_key_auth; /* assumed request_key authority */
133 #endif
134 #ifdef CONFIG_SECURITY
135 	void		*security;	/* LSM security */
136 #endif
137 	struct user_struct *user;	/* real user ID subscription */
138 	struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
139 	struct ucounts *ucounts;
140 	struct group_info *group_info;	/* supplementary groups for euid/fsgid */
141 	/* RCU deletion */
142 	union {
143 		int non_rcu;			/* Can we skip RCU deletion? */
144 		struct rcu_head	rcu;		/* RCU deletion hook */
145 	};
146 } __randomize_layout;
147 
148 extern void __put_cred(struct cred *);
149 extern void exit_creds(struct task_struct *);
150 extern int copy_creds(struct task_struct *, unsigned long);
151 extern const struct cred *get_task_cred(struct task_struct *);
152 extern struct cred *cred_alloc_blank(void);
153 extern struct cred *prepare_creds(void);
154 extern struct cred *prepare_exec_creds(void);
155 extern int commit_creds(struct cred *);
156 extern void abort_creds(struct cred *);
157 extern const struct cred *override_creds(const struct cred *);
158 extern void revert_creds(const struct cred *);
159 extern struct cred *prepare_kernel_cred(struct task_struct *);
160 extern int set_security_override(struct cred *, u32);
161 extern int set_security_override_from_ctx(struct cred *, const char *);
162 extern int set_create_files_as(struct cred *, struct inode *);
163 extern int cred_fscmp(const struct cred *, const struct cred *);
164 extern void __init cred_init(void);
165 extern int set_cred_ucounts(struct cred *);
166 
cap_ambient_invariant_ok(const struct cred * cred)167 static inline bool cap_ambient_invariant_ok(const struct cred *cred)
168 {
169 	return cap_issubset(cred->cap_ambient,
170 			    cap_intersect(cred->cap_permitted,
171 					  cred->cap_inheritable));
172 }
173 
174 /**
175  * get_new_cred - Get a reference on a new set of credentials
176  * @cred: The new credentials to reference
177  *
178  * Get a reference on the specified set of new credentials.  The caller must
179  * release the reference.
180  */
get_new_cred(struct cred * cred)181 static inline struct cred *get_new_cred(struct cred *cred)
182 {
183 	atomic_long_inc(&cred->usage);
184 	return cred;
185 }
186 
187 /**
188  * get_cred - Get a reference on a set of credentials
189  * @cred: The credentials to reference
190  *
191  * Get a reference on the specified set of credentials.  The caller must
192  * release the reference.  If %NULL is passed, it is returned with no action.
193  *
194  * This is used to deal with a committed set of credentials.  Although the
195  * pointer is const, this will temporarily discard the const and increment the
196  * usage count.  The purpose of this is to attempt to catch at compile time the
197  * accidental alteration of a set of credentials that should be considered
198  * immutable.
199  */
get_cred(const struct cred * cred)200 static inline const struct cred *get_cred(const struct cred *cred)
201 {
202 	struct cred *nonconst_cred = (struct cred *) cred;
203 	if (!cred)
204 		return cred;
205 	nonconst_cred->non_rcu = 0;
206 	return get_new_cred(nonconst_cred);
207 }
208 
get_cred_rcu(const struct cred * cred)209 static inline const struct cred *get_cred_rcu(const struct cred *cred)
210 {
211 	struct cred *nonconst_cred = (struct cred *) cred;
212 	if (!cred)
213 		return NULL;
214 	if (!atomic_long_inc_not_zero(&nonconst_cred->usage))
215 		return NULL;
216 	nonconst_cred->non_rcu = 0;
217 	return cred;
218 }
219 
220 /**
221  * put_cred - Release a reference to a set of credentials
222  * @cred: The credentials to release
223  *
224  * Release a reference to a set of credentials, deleting them when the last ref
225  * is released.  If %NULL is passed, nothing is done.
226  *
227  * This takes a const pointer to a set of credentials because the credentials
228  * on task_struct are attached by const pointers to prevent accidental
229  * alteration of otherwise immutable credential sets.
230  */
put_cred(const struct cred * _cred)231 static inline void put_cred(const struct cred *_cred)
232 {
233 	struct cred *cred = (struct cred *) _cred;
234 
235 	if (cred) {
236 		if (atomic_long_dec_and_test(&(cred)->usage))
237 			__put_cred(cred);
238 	}
239 }
240 
241 /**
242  * current_cred - Access the current task's subjective credentials
243  *
244  * Access the subjective credentials of the current task.  RCU-safe,
245  * since nobody else can modify it.
246  */
247 #define current_cred() \
248 	rcu_dereference_protected(current->cred, 1)
249 
250 /**
251  * current_real_cred - Access the current task's objective credentials
252  *
253  * Access the objective credentials of the current task.  RCU-safe,
254  * since nobody else can modify it.
255  */
256 #define current_real_cred() \
257 	rcu_dereference_protected(current->real_cred, 1)
258 
259 /**
260  * __task_cred - Access a task's objective credentials
261  * @task: The task to query
262  *
263  * Access the objective credentials of a task.  The caller must hold the RCU
264  * readlock.
265  *
266  * The result of this function should not be passed directly to get_cred();
267  * rather get_task_cred() should be used instead.
268  */
269 #define __task_cred(task)	\
270 	rcu_dereference((task)->real_cred)
271 
272 /**
273  * get_current_cred - Get the current task's subjective credentials
274  *
275  * Get the subjective credentials of the current task, pinning them so that
276  * they can't go away.  Accessing the current task's credentials directly is
277  * not permitted.
278  */
279 #define get_current_cred()				\
280 	(get_cred(current_cred()))
281 
282 /**
283  * get_current_user - Get the current task's user_struct
284  *
285  * Get the user record of the current task, pinning it so that it can't go
286  * away.
287  */
288 #define get_current_user()				\
289 ({							\
290 	struct user_struct *__u;			\
291 	const struct cred *__cred;			\
292 	__cred = current_cred();			\
293 	__u = get_uid(__cred->user);			\
294 	__u;						\
295 })
296 
297 /**
298  * get_current_groups - Get the current task's supplementary group list
299  *
300  * Get the supplementary group list of the current task, pinning it so that it
301  * can't go away.
302  */
303 #define get_current_groups()				\
304 ({							\
305 	struct group_info *__groups;			\
306 	const struct cred *__cred;			\
307 	__cred = current_cred();			\
308 	__groups = get_group_info(__cred->group_info);	\
309 	__groups;					\
310 })
311 
312 #define task_cred_xxx(task, xxx)			\
313 ({							\
314 	__typeof__(((struct cred *)NULL)->xxx) ___val;	\
315 	rcu_read_lock();				\
316 	___val = __task_cred((task))->xxx;		\
317 	rcu_read_unlock();				\
318 	___val;						\
319 })
320 
321 #define task_uid(task)		(task_cred_xxx((task), uid))
322 #define task_euid(task)		(task_cred_xxx((task), euid))
323 #define task_ucounts(task)	(task_cred_xxx((task), ucounts))
324 
325 #define current_cred_xxx(xxx)			\
326 ({						\
327 	current_cred()->xxx;			\
328 })
329 
330 #define current_uid()		(current_cred_xxx(uid))
331 #define current_gid()		(current_cred_xxx(gid))
332 #define current_euid()		(current_cred_xxx(euid))
333 #define current_egid()		(current_cred_xxx(egid))
334 #define current_suid()		(current_cred_xxx(suid))
335 #define current_sgid()		(current_cred_xxx(sgid))
336 #define current_fsuid() 	(current_cred_xxx(fsuid))
337 #define current_fsgid() 	(current_cred_xxx(fsgid))
338 #define current_cap()		(current_cred_xxx(cap_effective))
339 #define current_user()		(current_cred_xxx(user))
340 #define current_ucounts()	(current_cred_xxx(ucounts))
341 
342 extern struct user_namespace init_user_ns;
343 #ifdef CONFIG_USER_NS
344 #define current_user_ns()	(current_cred_xxx(user_ns))
345 #else
current_user_ns(void)346 static inline struct user_namespace *current_user_ns(void)
347 {
348 	return &init_user_ns;
349 }
350 #endif
351 
352 
353 #define current_uid_gid(_uid, _gid)		\
354 do {						\
355 	const struct cred *__cred;		\
356 	__cred = current_cred();		\
357 	*(_uid) = __cred->uid;			\
358 	*(_gid) = __cred->gid;			\
359 } while(0)
360 
361 #define current_euid_egid(_euid, _egid)		\
362 do {						\
363 	const struct cred *__cred;		\
364 	__cred = current_cred();		\
365 	*(_euid) = __cred->euid;		\
366 	*(_egid) = __cred->egid;		\
367 } while(0)
368 
369 #define current_fsuid_fsgid(_fsuid, _fsgid)	\
370 do {						\
371 	const struct cred *__cred;		\
372 	__cred = current_cred();		\
373 	*(_fsuid) = __cred->fsuid;		\
374 	*(_fsgid) = __cred->fsgid;		\
375 } while(0)
376 
377 #endif /* _LINUX_CRED_H */
378