kernel/cred.c

   1 /* Task credentials management - see Documentation/security/credentials.rst
   2  *
   3  * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells (dhowells@redhat.com)
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public Licence
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the Licence, or (at your option) any later version.
  10  */
  11 #include <linux/export.h>
  12 #include <linux/cred.h>
  13 #include <linux/slab.h>
  14 #include <linux/sched.h>
  15 #include <linux/sched/coredump.h>
  16 #include <linux/key.h>
  17 #include <linux/keyctl.h>
  18 #include <linux/init_task.h>
  19 #include <linux/security.h>
  20 #include <linux/binfmts.h>
  21 #include <linux/cn_proc.h>
  22
  23 #if 0
  24 #define kdebug(FMT, ...)                                                \
  25         printk("[%-5.5s%5u] " FMT "\n",                                 \
  26                current->comm, current->pid, ##__VA_ARGS__)
  27 #else
  28 #define kdebug(FMT, ...)                                                \
  29 do {                                                                    \
  30         if (0)                                                          \
  31                 no_printk("[%-5.5s%5u] " FMT "\n",                      \
  32                           current->comm, current->pid, ##__VA_ARGS__);  \
  33 } while (0)
  34 #endif
  35
  36 static struct kmem_cache *cred_jar;
  37
  38 /* init to 2 - one for init_task, one to ensure it is never freed */
  39 struct group_info init_groups = { .usage = ATOMIC_INIT(2) };
  40
  41 /*
  42  * The initial credentials for the initial task
  43  */
  44 struct cred init_cred = {
  45         .usage                  = ATOMIC_INIT(4),
  46 #ifdef CONFIG_DEBUG_CREDENTIALS
  47         .subscribers            = ATOMIC_INIT(2),
  48         .magic                  = CRED_MAGIC,
  49 #endif
  50         .uid                    = GLOBAL_ROOT_UID,
  51         .gid                    = GLOBAL_ROOT_GID,
  52         .suid                   = GLOBAL_ROOT_UID,
  53         .sgid                   = GLOBAL_ROOT_GID,
  54         .euid                   = GLOBAL_ROOT_UID,
  55         .egid                   = GLOBAL_ROOT_GID,
  56         .fsuid                  = GLOBAL_ROOT_UID,
  57         .fsgid                  = GLOBAL_ROOT_GID,
  58         .securebits             = SECUREBITS_DEFAULT,
  59         .cap_inheritable        = CAP_EMPTY_SET,
  60         .cap_permitted          = CAP_FULL_SET,
  61         .cap_effective          = CAP_FULL_SET,
  62         .cap_bset               = CAP_FULL_SET,
  63         .user                   = INIT_USER,
  64         .user_ns                = &init_user_ns,
  65         .group_info             = &init_groups,
  66 };
  67
  68 static inline void set_cred_subscribers(struct cred *cred, int n)
  69 {
  70 #ifdef CONFIG_DEBUG_CREDENTIALS
  71         atomic_set(&cred->subscribers, n);
  72 #endif
  73 }
  74
  75 static inline int read_cred_subscribers(const struct cred *cred)
  76 {
  77 #ifdef CONFIG_DEBUG_CREDENTIALS
  78         return atomic_read(&cred->subscribers);
  79 #else
  80         return 0;
  81 #endif
  82 }
  83
  84 static inline void alter_cred_subscribers(const struct cred *_cred, int n)
  85 {
  86 #ifdef CONFIG_DEBUG_CREDENTIALS
  87         struct cred *cred = (struct cred *) _cred;
  88
  89         atomic_add(n, &cred->subscribers);
  90 #endif
  91 }
  92
  93 /*
  94  * The RCU callback to actually dispose of a set of credentials
  95  */
  96 static void put_cred_rcu(struct rcu_head *rcu)
  97 {
  98         struct cred *cred = container_of(rcu, struct cred, rcu);
  99
 100         kdebug("put_cred_rcu(%p)", cred);
 101
 102 #ifdef CONFIG_DEBUG_CREDENTIALS
 103         if (cred->magic != CRED_MAGIC_DEAD ||
 104             atomic_read(&cred->usage) != 0 ||
 105             read_cred_subscribers(cred) != 0)
 106                 panic("CRED: put_cred_rcu() sees %p with"
 107                       " mag %x, put %p, usage %d, subscr %d\n",
 108                       cred, cred->magic, cred->put_addr,
 109                       atomic_read(&cred->usage),
 110                       read_cred_subscribers(cred));
 111 #else
 112         if (atomic_read(&cred->usage) != 0)
 113                 panic("CRED: put_cred_rcu() sees %p with usage %d\n",
 114                       cred, atomic_read(&cred->usage));
 115 #endif
 116
 117         security_cred_free(cred);
 118         key_put(cred->session_keyring);
 119         key_put(cred->process_keyring);
 120         key_put(cred->thread_keyring);
 121         key_put(cred->request_key_auth);
 122         if (cred->group_info)
 123                 put_group_info(cred->group_info);
 124         free_uid(cred->user);
 125         put_user_ns(cred->user_ns);
 126         kmem_cache_free(cred_jar, cred);
 127 }
 128
 129 /**
 130  * __put_cred - Destroy a set of credentials
 131  * @cred: The record to release
 132  *
 133  * Destroy a set of credentials on which no references remain.
 134  */
 135 void __put_cred(struct cred *cred)
 136 {
 137         kdebug("__put_cred(%p{%d,%d})", cred,
 138                atomic_read(&cred->usage),
 139                read_cred_subscribers(cred));
 140
 141         BUG_ON(atomic_read(&cred->usage) != 0);
 142 #ifdef CONFIG_DEBUG_CREDENTIALS
 143         BUG_ON(read_cred_subscribers(cred) != 0);
 144         cred->magic = CRED_MAGIC_DEAD;
 145         cred->put_addr = __builtin_return_address(0);
 146 #endif
 147         BUG_ON(cred == current->cred);
 148         BUG_ON(cred == current->real_cred);
 149
 150         if (cred->non_rcu)
 151                 put_cred_rcu(&cred->rcu);
 152         else
 153                 call_rcu(&cred->rcu, put_cred_rcu);
 154 }
 155 EXPORT_SYMBOL(__put_cred);
 156
 157 /*
 158  * Clean up a task's credentials when it exits
 159  */
 160 void exit_creds(struct task_struct *tsk)
 161 {
 162         struct cred *cred;
 163
 164         kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
 165                atomic_read(&tsk->cred->usage),
 166                read_cred_subscribers(tsk->cred));
 167
 168         cred = (struct cred *) tsk->real_cred;
 169         tsk->real_cred = NULL;
 170         validate_creds(cred);
 171         alter_cred_subscribers(cred, -1);
 172         put_cred(cred);
 173
 174         cred = (struct cred *) tsk->cred;
 175         tsk->cred = NULL;
 176         validate_creds(cred);
 177         alter_cred_subscribers(cred, -1);
 178         put_cred(cred);
 179 }
 180
 181 /**
 182  * get_task_cred - Get another task's objective credentials
 183  * @task: The task to query
 184  *
 185  * Get the objective credentials of a task, pinning them so that they can't go
 186  * away.  Accessing a task's credentials directly is not permitted.
 187  *
 188  * The caller must also make sure task doesn't get deleted, either by holding a
 189  * ref on task or by holding tasklist_lock to prevent it from being unlinked.
 190  */
 191 const struct cred *get_task_cred(struct task_struct *task)
 192 {
 193         const struct cred *cred;
 194
 195         rcu_read_lock();
 196
 197         do {
 198                 cred = __task_cred((task));
 199                 BUG_ON(!cred);
 200         } while (!atomic_inc_not_zero(&((struct cred *)cred)->usage));
 201
 202         rcu_read_unlock();
 203         return cred;
 204 }
 205
 206 /*
 207  * Allocate blank credentials, such that the credentials can be filled in at a
 208  * later date without risk of ENOMEM.
 209  */
 210 struct cred *cred_alloc_blank(void)
 211 {
 212         struct cred *new;
 213
 214         new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
 215         if (!new)
 216                 return NULL;
 217
 218         atomic_set(&new->usage, 1);
 219 #ifdef CONFIG_DEBUG_CREDENTIALS
 220         new->magic = CRED_MAGIC;
 221 #endif
 222
 223         if (security_cred_alloc_blank(new, GFP_KERNEL_ACCOUNT) < 0)
 224                 goto error;
 225
 226         return new;
 227
 228 error:
 229         abort_creds(new);
 230         return NULL;
 231 }
 232
 233 /**
 234  * prepare_creds - Prepare a new set of credentials for modification
 235  *
 236  * Prepare a new set of task credentials for modification.  A task's creds
 237  * shouldn't generally be modified directly, therefore this function is used to
 238  * prepare a new copy, which the caller then modifies and then commits by
 239  * calling commit_creds().
 240  *
 241  * Preparation involves making a copy of the objective creds for modification.
 242  *
 243  * Returns a pointer to the new creds-to-be if successful, NULL otherwise.
 244  *
 245  * Call commit_creds() or abort_creds() to clean up.
 246  */
 247 struct cred *prepare_creds(void)
 248 {
 249         struct task_struct *task = current;
 250         const struct cred *old;
 251         struct cred *new;
 252
 253         validate_process_creds();
 254
 255         new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
 256         if (!new)
 257                 return NULL;
 258
 259         kdebug("prepare_creds() alloc %p", new);
 260
 261         old = task->cred;
 262         memcpy(new, old, sizeof(struct cred));
 263
 264         new->non_rcu = 0;
 265         atomic_set(&new->usage, 1);
 266         set_cred_subscribers(new, 0);
 267         get_group_info(new->group_info);
 268         get_uid(new->user);
 269         get_user_ns(new->user_ns);
 270
 271 #ifdef CONFIG_KEYS
 272         key_get(new->session_keyring);
 273         key_get(new->process_keyring);
 274         key_get(new->thread_keyring);
 275         key_get(new->request_key_auth);
 276 #endif
 277
 278 #ifdef CONFIG_SECURITY
 279         new->security = NULL;
 280 #endif
 281
 282         if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
 283                 goto error;
 284         validate_creds(new);
 285         return new;
 286
 287 error:
 288         abort_creds(new);
 289         return NULL;
 290 }
 291 EXPORT_SYMBOL(prepare_creds);
 292
 293 /*
 294  * Prepare credentials for current to perform an execve()
 295  * - The caller must hold ->cred_guard_mutex
 296  */
 297 struct cred *prepare_exec_creds(void)
 298 {
 299         struct cred *new;
 300
 301         new = prepare_creds();
 302         if (!new)
 303                 return new;
 304
 305 #ifdef CONFIG_KEYS
 306         /* newly exec'd tasks don't get a thread keyring */
 307         key_put(new->thread_keyring);
 308         new->thread_keyring = NULL;
 309
 310         /* inherit the session keyring; new process keyring */
 311         key_put(new->process_keyring);
 312         new->process_keyring = NULL;
 313 #endif
 314
 315         return new;
 316 }
 317
 318 /*
 319  * Copy credentials for the new process created by fork()
 320  *
 321  * We share if we can, but under some circumstances we have to generate a new
 322  * set.
 323  *
 324  * The new process gets the current process's subjective credentials as its
 325  * objective and subjective credentials
 326  */
 327 int copy_creds(struct task_struct *p, unsigned long clone_flags)
 328 {
 329         struct cred *new;
 330         int ret;
 331
 332         if (
 333 #ifdef CONFIG_KEYS
 334                 !p->cred->thread_keyring &&
 335 #endif
 336                 clone_flags & CLONE_THREAD
 337             ) {
 338                 p->real_cred = get_cred(p->cred);
 339                 get_cred(p->cred);
 340                 alter_cred_subscribers(p->cred, 2);
 341                 kdebug("share_creds(%p{%d,%d})",
 342                        p->cred, atomic_read(&p->cred->usage),
 343                        read_cred_subscribers(p->cred));
 344                 atomic_inc(&p->cred->user->processes);
 345                 return 0;
 346         }
 347
 348         new = prepare_creds();
 349         if (!new)
 350                 return -ENOMEM;
 351
 352         if (clone_flags & CLONE_NEWUSER) {
 353                 ret = create_user_ns(new);
 354                 if (ret < 0)
 355                         goto error_put;
 356         }
 357
 358 #ifdef CONFIG_KEYS
 359         /* new threads get their own thread keyrings if their parent already
 360          * had one */
 361         if (new->thread_keyring) {
 362                 key_put(new->thread_keyring);
 363                 new->thread_keyring = NULL;
 364                 if (clone_flags & CLONE_THREAD)
 365                         install_thread_keyring_to_cred(new);
 366         }
 367
 368         /* The process keyring is only shared between the threads in a process;
 369          * anything outside of those threads doesn't inherit.
 370          */
 371         if (!(clone_flags & CLONE_THREAD)) {
 372                 key_put(new->process_keyring);
 373                 new->process_keyring = NULL;
 374         }
 375 #endif
 376
 377         atomic_inc(&new->user->processes);
 378         p->cred = p->real_cred = get_cred(new);
 379         alter_cred_subscribers(new, 2);
 380         validate_creds(new);
 381         return 0;
 382
 383 error_put:
 384         put_cred(new);
 385         return ret;
 386 }
 387
 388 static bool cred_cap_issubset(const struct cred *set, const struct cred *subset)
 389 {
 390         const struct user_namespace *set_ns = set->user_ns;
 391         const struct user_namespace *subset_ns = subset->user_ns;
 392
 393         /* If the two credentials are in the same user namespace see if
 394          * the capabilities of subset are a subset of set.
 395          */
 396         if (set_ns == subset_ns)
 397                 return cap_issubset(subset->cap_permitted, set->cap_permitted);
 398
 399         /* The credentials are in a different user namespaces
 400          * therefore one is a subset of the other only if a set is an
 401          * ancestor of subset and set->euid is owner of subset or one
 402          * of subsets ancestors.
 403          */
 404         for (;subset_ns != &init_user_ns; subset_ns = subset_ns->parent) {
 405                 if ((set_ns == subset_ns->parent)  &&
 406                     uid_eq(subset_ns->owner, set->euid))
 407                         return true;
 408         }
 409
 410         return false;
 411 }
 412
 413 /**
 414  * commit_creds - Install new credentials upon the current task
 415  * @new: The credentials to be assigned
 416  *
 417  * Install a new set of credentials to the current task, using RCU to replace
 418  * the old set.  Both the objective and the subjective credentials pointers are
 419  * updated.  This function may not be called if the subjective credentials are
 420  * in an overridden state.
 421  *
 422  * This function eats the caller's reference to the new credentials.
 423  *
 424  * Always returns 0 thus allowing this function to be tail-called at the end
 425  * of, say, sys_setgid().
 426  */
 427 int commit_creds(struct cred *new)
 428 {
 429         struct task_struct *task = current;
 430         const struct cred *old = task->real_cred;
 431
 432         kdebug("commit_creds(%p{%d,%d})", new,
 433                atomic_read(&new->usage),
 434                read_cred_subscribers(new));
 435
 436         BUG_ON(task->cred != old);
 437 #ifdef CONFIG_DEBUG_CREDENTIALS
 438         BUG_ON(read_cred_subscribers(old) < 2);
 439         validate_creds(old);
 440         validate_creds(new);
 441 #endif
 442         BUG_ON(atomic_read(&new->usage) < 1);
 443
 444         get_cred(new); /* we will require a ref for the subj creds too */
 445
 446         /* dumpability changes */
 447         if (!uid_eq(old->euid, new->euid) ||
 448             !gid_eq(old->egid, new->egid) ||
 449             !uid_eq(old->fsuid, new->fsuid) ||
 450             !gid_eq(old->fsgid, new->fsgid) ||
 451             !cred_cap_issubset(old, new)) {
 452                 if (task->mm)
 453                         set_dumpable(task->mm, suid_dumpable);
 454                 task->pdeath_signal = 0;
 455                 /*
 456                  * If a task drops privileges and becomes nondumpable,
 457                  * the dumpability change must become visible before
 458                  * the credential change; otherwise, a __ptrace_may_access()
 459                  * racing with this change may be able to attach to a task it
 460                  * shouldn't be able to attach to (as if the task had dropped
 461                  * privileges without becoming nondumpable).
 462                  * Pairs with a read barrier in __ptrace_may_access().
 463                  */
 464                 smp_wmb();
 465         }
 466
 467         /* alter the thread keyring */
 468         if (!uid_eq(new->fsuid, old->fsuid))
 469                 key_fsuid_changed(task);
 470         if (!gid_eq(new->fsgid, old->fsgid))
 471                 key_fsgid_changed(task);
 472
 473         /* do it
 474          * RLIMIT_NPROC limits on user->processes have already been checked
 475          * in set_user().
 476          */
 477         alter_cred_subscribers(new, 2);
 478         if (new->user != old->user)
 479                 atomic_inc(&new->user->processes);
 480         rcu_assign_pointer(task->real_cred, new);
 481         rcu_assign_pointer(task->cred, new);
 482         if (new->user != old->user)
 483                 atomic_dec(&old->user->processes);
 484         alter_cred_subscribers(old, -2);
 485
 486         /* send notifications */
 487         if (!uid_eq(new->uid,   old->uid)  ||
 488             !uid_eq(new->euid,  old->euid) ||
 489             !uid_eq(new->suid,  old->suid) ||
 490             !uid_eq(new->fsuid, old->fsuid))
 491                 proc_id_connector(task, PROC_EVENT_UID);
 492
 493         if (!gid_eq(new->gid,   old->gid)  ||
 494             !gid_eq(new->egid,  old->egid) ||
 495             !gid_eq(new->sgid,  old->sgid) ||
 496             !gid_eq(new->fsgid, old->fsgid))
 497                 proc_id_connector(task, PROC_EVENT_GID);
 498
 499         /* release the old obj and subj refs both */
 500         put_cred(old);
 501         put_cred(old);
 502         return 0;
 503 }
 504 EXPORT_SYMBOL(commit_creds);
 505
 506 /**
 507  * abort_creds - Discard a set of credentials and unlock the current task
 508  * @new: The credentials that were going to be applied
 509  *
 510  * Discard a set of credentials that were under construction and unlock the
 511  * current task.
 512  */
 513 void abort_creds(struct cred *new)
 514 {
 515         kdebug("abort_creds(%p{%d,%d})", new,
 516                atomic_read(&new->usage),
 517                read_cred_subscribers(new));
 518
 519 #ifdef CONFIG_DEBUG_CREDENTIALS
 520         BUG_ON(read_cred_subscribers(new) != 0);
 521 #endif
 522         BUG_ON(atomic_read(&new->usage) < 1);
 523         put_cred(new);
 524 }
 525 EXPORT_SYMBOL(abort_creds);
 526
 527 /**
 528  * override_creds - Override the current process's subjective credentials
 529  * @new: The credentials to be assigned
 530  *
 531  * Install a set of temporary override subjective credentials on the current
 532  * process, returning the old set for later reversion.
 533  */
 534 const struct cred *override_creds(const struct cred *new)
 535 {
 536         const struct cred *old = current->cred;
 537
 538         kdebug("override_creds(%p{%d,%d})", new,
 539                atomic_read(&new->usage),
 540                read_cred_subscribers(new));
 541
 542         validate_creds(old);
 543         validate_creds(new);
 544
 545         /*
 546          * NOTE! This uses 'get_new_cred()' rather than 'get_cred()'.
 547          *
 548          * That means that we do not clear the 'non_rcu' flag, since
 549          * we are only installing the cred into the thread-synchronous
 550          * '->cred' pointer, not the '->real_cred' pointer that is
 551          * visible to other threads under RCU.
 552          *
 553          * Also note that we did validate_creds() manually, not depending
 554          * on the validation in 'get_cred()'.
 555          */
 556         get_new_cred((struct cred *)new);
 557         alter_cred_subscribers(new, 1);
 558         rcu_assign_pointer(current->cred, new);
 559         alter_cred_subscribers(old, -1);
 560
 561         kdebug("override_creds() = %p{%d,%d}", old,
 562                atomic_read(&old->usage),
 563                read_cred_subscribers(old));
 564         return old;
 565 }
 566 EXPORT_SYMBOL(override_creds);
 567
 568 /**
 569  * revert_creds - Revert a temporary subjective credentials override
 570  * @old: The credentials to be restored
 571  *
 572  * Revert a temporary set of override subjective credentials to an old set,
 573  * discarding the override set.
 574  */
 575 void revert_creds(const struct cred *old)
 576 {
 577         const struct cred *override = current->cred;
 578
 579         kdebug("revert_creds(%p{%d,%d})", old,
 580                atomic_read(&old->usage),
 581                read_cred_subscribers(old));
 582
 583         validate_creds(old);
 584         validate_creds(override);
 585         alter_cred_subscribers(old, 1);
 586         rcu_assign_pointer(current->cred, old);
 587         alter_cred_subscribers(override, -1);
 588         put_cred(override);
 589 }
 590 EXPORT_SYMBOL(revert_creds);
 591
 592 /*
 593  * initialise the credentials stuff
 594  */
 595 void __init cred_init(void)
 596 {
 597         /* allocate a slab in which we can store credentials */
 598         cred_jar = kmem_cache_create("cred_jar", sizeof(struct cred), 0,
 599                         SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, NULL);
 600 }
 601
 602 /**
 603  * prepare_kernel_cred - Prepare a set of credentials for a kernel service
 604  * @daemon: A userspace daemon to be used as a reference
 605  *
 606  * Prepare a set of credentials for a kernel service.  This can then be used to
 607  * override a task's own credentials so that work can be done on behalf of that
 608  * task that requires a different subjective context.
 609  *
 610  * @daemon is used to provide a base for the security record, but can be NULL.
 611  * If @daemon is supplied, then the security data will be derived from that;
 612  * otherwise they'll be set to 0 and no groups, full capabilities and no keys.
 613  *
 614  * The caller may change these controls afterwards if desired.
 615  *
 616  * Returns the new credentials or NULL if out of memory.
 617  *
 618  * Does not take, and does not return holding current->cred_replace_mutex.
 619  */
 620 struct cred *prepare_kernel_cred(struct task_struct *daemon)
 621 {
 622         const struct cred *old;
 623         struct cred *new;
 624
 625         new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
 626         if (!new)
 627                 return NULL;
 628
 629         kdebug("prepare_kernel_cred() alloc %p", new);
 630
 631         if (daemon)
 632                 old = get_task_cred(daemon);
 633         else
 634                 old = get_cred(&init_cred);
 635
 636         validate_creds(old);
 637
 638         *new = *old;
 639         new->non_rcu = 0;
 640         atomic_set(&new->usage, 1);
 641         set_cred_subscribers(new, 0);
 642         get_uid(new->user);
 643         get_user_ns(new->user_ns);
 644         get_group_info(new->group_info);
 645
 646 #ifdef CONFIG_KEYS
 647         new->session_keyring = NULL;
 648         new->process_keyring = NULL;
 649         new->thread_keyring = NULL;
 650         new->request_key_auth = NULL;
 651         new->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
 652 #endif
 653
 654 #ifdef CONFIG_SECURITY
 655         new->security = NULL;
 656 #endif
 657         if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0)
 658                 goto error;
 659
 660         put_cred(old);
 661         validate_creds(new);
 662         return new;
 663
 664 error:
 665         put_cred(new);
 666         put_cred(old);
 667         return NULL;
 668 }
 669 EXPORT_SYMBOL(prepare_kernel_cred);
 670
 671 /**
 672  * set_security_override - Set the security ID in a set of credentials
 673  * @new: The credentials to alter
 674  * @secid: The LSM security ID to set
 675  *
 676  * Set the LSM security ID in a set of credentials so that the subjective
 677  * security is overridden when an alternative set of credentials is used.
 678  */
 679 int set_security_override(struct cred *new, u32 secid)
 680 {
 681         return security_kernel_act_as(new, secid);
 682 }
 683 EXPORT_SYMBOL(set_security_override);
 684
 685 /**
 686  * set_security_override_from_ctx - Set the security ID in a set of credentials
 687  * @new: The credentials to alter
 688  * @secctx: The LSM security context to generate the security ID from.
 689  *
 690  * Set the LSM security ID in a set of credentials so that the subjective
 691  * security is overridden when an alternative set of credentials is used.  The
 692  * security ID is specified in string form as a security context to be
 693  * interpreted by the LSM.
 694  */
 695 int set_security_override_from_ctx(struct cred *new, const char *secctx)
 696 {
 697         u32 secid;
 698         int ret;
 699
 700         ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
 701         if (ret < 0)
 702                 return ret;
 703
 704         return set_security_override(new, secid);
 705 }
 706 EXPORT_SYMBOL(set_security_override_from_ctx);
 707
 708 /**
 709  * set_create_files_as - Set the LSM file create context in a set of credentials
 710  * @new: The credentials to alter
 711  * @inode: The inode to take the context from
 712  *
 713  * Change the LSM file creation context in a set of credentials to be the same
 714  * as the object context of the specified inode, so that the new inodes have
 715  * the same MAC context as that inode.
 716  */
 717 int set_create_files_as(struct cred *new, struct inode *inode)
 718 {
 719         if (!uid_valid(inode->i_uid) || !gid_valid(inode->i_gid))
 720                 return -EINVAL;
 721         new->fsuid = inode->i_uid;
 722         new->fsgid = inode->i_gid;
 723         return security_kernel_create_files_as(new, inode);
 724 }
 725 EXPORT_SYMBOL(set_create_files_as);
 726
 727 #ifdef CONFIG_DEBUG_CREDENTIALS
 728
 729 bool creds_are_invalid(const struct cred *cred)
 730 {
 731         if (cred->magic != CRED_MAGIC)
 732                 return true;
 733 #ifdef CONFIG_SECURITY_SELINUX
 734         /*
 735          * cred->security == NULL if security_cred_alloc_blank() or
 736          * security_prepare_creds() returned an error.
 737          */
 738         if (selinux_is_enabled() && cred->security) {
 739                 if ((unsigned long) cred->security < PAGE_SIZE)
 740                         return true;
 741                 if ((*(u32 *)cred->security & 0xffffff00) ==
 742                     (POISON_FREE << 24 | POISON_FREE << 16 | POISON_FREE << 8))
 743                         return true;
 744         }
 745 #endif
 746         return false;
 747 }
 748 EXPORT_SYMBOL(creds_are_invalid);
 749
 750 /*
 751  * dump invalid credentials
 752  */
 753 static void dump_invalid_creds(const struct cred *cred, const char *label,
 754                                const struct task_struct *tsk)
 755 {
 756         printk(KERN_ERR "CRED: %s credentials: %p %s%s%s\n",
 757                label, cred,
 758                cred == &init_cred ? "[init]" : "",
 759                cred == tsk->real_cred ? "[real]" : "",
 760                cred == tsk->cred ? "[eff]" : "");
 761         printk(KERN_ERR "CRED: ->magic=%x, put_addr=%p\n",
 762                cred->magic, cred->put_addr);
 763         printk(KERN_ERR "CRED: ->usage=%d, subscr=%d\n",
 764                atomic_read(&cred->usage),
 765                read_cred_subscribers(cred));
 766         printk(KERN_ERR "CRED: ->*uid = { %d,%d,%d,%d }\n",
 767                 from_kuid_munged(&init_user_ns, cred->uid),
 768                 from_kuid_munged(&init_user_ns, cred->euid),
 769                 from_kuid_munged(&init_user_ns, cred->suid),
 770                 from_kuid_munged(&init_user_ns, cred->fsuid));
 771         printk(KERN_ERR "CRED: ->*gid = { %d,%d,%d,%d }\n",
 772                 from_kgid_munged(&init_user_ns, cred->gid),
 773                 from_kgid_munged(&init_user_ns, cred->egid),
 774                 from_kgid_munged(&init_user_ns, cred->sgid),
 775                 from_kgid_munged(&init_user_ns, cred->fsgid));
 776 #ifdef CONFIG_SECURITY
 777         printk(KERN_ERR "CRED: ->security is %p\n", cred->security);
 778         if ((unsigned long) cred->security >= PAGE_SIZE &&
 779             (((unsigned long) cred->security & 0xffffff00) !=
 780              (POISON_FREE << 24 | POISON_FREE << 16 | POISON_FREE << 8)))
 781                 printk(KERN_ERR "CRED: ->security {%x, %x}\n",
 782                        ((u32*)cred->security)[0],
 783                        ((u32*)cred->security)[1]);
 784 #endif
 785 }
 786
 787 /*
 788  * report use of invalid credentials
 789  */
 790 void __invalid_creds(const struct cred *cred, const char *file, unsigned line)
 791 {
 792         printk(KERN_ERR "CRED: Invalid credentials\n");
 793         printk(KERN_ERR "CRED: At %s:%u\n", file, line);
 794         dump_invalid_creds(cred, "Specified", current);
 795         BUG();
 796 }
 797 EXPORT_SYMBOL(__invalid_creds);
 798
 799 /*
 800  * check the credentials on a process
 801  */
 802 void __validate_process_creds(struct task_struct *tsk,
 803                               const char *file, unsigned line)
 804 {
 805         if (tsk->cred == tsk->real_cred) {
 806                 if (unlikely(read_cred_subscribers(tsk->cred) < 2 ||
 807                              creds_are_invalid(tsk->cred)))
 808                         goto invalid_creds;
 809         } else {
 810                 if (unlikely(read_cred_subscribers(tsk->real_cred) < 1 ||
 811                              read_cred_subscribers(tsk->cred) < 1 ||
 812                              creds_are_invalid(tsk->real_cred) ||
 813                              creds_are_invalid(tsk->cred)))
 814                         goto invalid_creds;
 815         }
 816         return;
 817
 818 invalid_creds:
 819         printk(KERN_ERR "CRED: Invalid process credentials\n");
 820         printk(KERN_ERR "CRED: At %s:%u\n", file, line);
 821
 822         dump_invalid_creds(tsk->real_cred, "Real", tsk);
 823         if (tsk->cred != tsk->real_cred)
 824                 dump_invalid_creds(tsk->cred, "Effective", tsk);
 825         else
 826                 printk(KERN_ERR "CRED: Effective creds == Real creds\n");
 827         BUG();
 828 }
 829 EXPORT_SYMBOL(__validate_process_creds);
 830
 831 /*
 832  * check creds for do_exit()
 833  */
 834 void validate_creds_for_do_exit(struct task_struct *tsk)
 835 {
 836         kdebug("validate_creds_for_do_exit(%p,%p{%d,%d})",
 837                tsk->real_cred, tsk->cred,
 838                atomic_read(&tsk->cred->usage),
 839                read_cred_subscribers(tsk->cred));
 840
 841         __validate_process_creds(tsk, __FILE__, __LINE__);
 842 }
 843
 844 #endif /* CONFIG_DEBUG_CREDENTIALS */