1 /* scm.c - Socket level control messages processing.
3 * Author: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
4 * Alignment and value checking mods by Craig Metz
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public License
8 * as published by the Free Software Foundation; either version
9 * 2 of the License, or (at your option) any later version.
12 #include <linux/module.h>
13 #include <linux/signal.h>
14 #include <linux/capability.h>
15 #include <linux/errno.h>
16 #include <linux/sched.h>
18 #include <linux/kernel.h>
19 #include <linux/stat.h>
20 #include <linux/socket.h>
21 #include <linux/file.h>
22 #include <linux/fcntl.h>
23 #include <linux/net.h>
24 #include <linux/interrupt.h>
25 #include <linux/netdevice.h>
26 #include <linux/security.h>
27 #include <linux/pid.h>
28 #include <linux/nsproxy.h>
29 #include <linux/slab.h>
31 #include <asm/uaccess.h>
33 #include <net/protocol.h>
34 #include <linux/skbuff.h>
36 #include <net/compat.h>
38 #include <net/cls_cgroup.h>
42 * Only allow a user to send credentials, that they could set with
46 static __inline__
int scm_check_creds(struct ucred
*creds
)
48 const struct cred
*cred
= current_cred();
49 kuid_t uid
= make_kuid(cred
->user_ns
, creds
->uid
);
50 kgid_t gid
= make_kgid(cred
->user_ns
, creds
->gid
);
52 if (!uid_valid(uid
) || !gid_valid(gid
))
55 if ((creds
->pid
== task_tgid_vnr(current
) || nsown_capable(CAP_SYS_ADMIN
)) &&
56 ((uid_eq(uid
, cred
->uid
) || uid_eq(uid
, cred
->euid
) ||
57 uid_eq(uid
, cred
->suid
)) || nsown_capable(CAP_SETUID
)) &&
58 ((gid_eq(gid
, cred
->gid
) || gid_eq(gid
, cred
->egid
) ||
59 gid_eq(gid
, cred
->sgid
)) || nsown_capable(CAP_SETGID
))) {
65 static int scm_fp_copy(struct cmsghdr
*cmsg
, struct scm_fp_list
**fplp
)
67 int *fdp
= (int*)CMSG_DATA(cmsg
);
68 struct scm_fp_list
*fpl
= *fplp
;
72 num
= (cmsg
->cmsg_len
- CMSG_ALIGN(sizeof(struct cmsghdr
)))/sizeof(int);
82 fpl
= kmalloc(sizeof(struct scm_fp_list
), GFP_KERNEL
);
87 fpl
->max
= SCM_MAX_FD
;
89 fpp
= &fpl
->fp
[fpl
->count
];
91 if (fpl
->count
+ num
> fpl
->max
)
95 * Verify the descriptors and increment the usage count.
98 for (i
=0; i
< num
; i
++)
103 if (fd
< 0 || !(file
= fget_raw(fd
)))
111 void __scm_destroy(struct scm_cookie
*scm
)
113 struct scm_fp_list
*fpl
= scm
->fp
;
118 for (i
=fpl
->count
-1; i
>=0; i
--)
123 EXPORT_SYMBOL(__scm_destroy
);
125 int __scm_send(struct socket
*sock
, struct msghdr
*msg
, struct scm_cookie
*p
)
127 struct cmsghdr
*cmsg
;
130 for (cmsg
= CMSG_FIRSTHDR(msg
); cmsg
; cmsg
= CMSG_NXTHDR(msg
, cmsg
))
134 /* Verify that cmsg_len is at least sizeof(struct cmsghdr) */
135 /* The first check was omitted in <= 2.2.5. The reasoning was
136 that parser checks cmsg_len in any case, so that
137 additional check would be work duplication.
138 But if cmsg_level is not SOL_SOCKET, we do not check
139 for too short ancillary data object at all! Oops.
142 if (!CMSG_OK(msg
, cmsg
))
145 if (cmsg
->cmsg_level
!= SOL_SOCKET
)
148 switch (cmsg
->cmsg_type
)
151 if (!sock
->ops
|| sock
->ops
->family
!= PF_UNIX
)
153 err
=scm_fp_copy(cmsg
, &p
->fp
);
157 case SCM_CREDENTIALS
:
162 if (cmsg
->cmsg_len
!= CMSG_LEN(sizeof(struct ucred
)))
164 memcpy(&creds
, CMSG_DATA(cmsg
), sizeof(struct ucred
));
165 err
= scm_check_creds(&creds
);
169 p
->creds
.pid
= creds
.pid
;
170 if (!p
->pid
|| pid_vnr(p
->pid
) != creds
.pid
) {
173 pid
= find_get_pid(creds
.pid
);
181 uid
= make_kuid(current_user_ns(), creds
.uid
);
182 gid
= make_kgid(current_user_ns(), creds
.gid
);
183 if (!uid_valid(uid
) || !gid_valid(gid
))
190 !uid_eq(p
->cred
->euid
, uid
) ||
191 !gid_eq(p
->cred
->egid
, gid
)) {
194 cred
= prepare_creds();
198 cred
->uid
= cred
->euid
= uid
;
199 cred
->gid
= cred
->egid
= gid
;
211 if (p
->fp
&& !p
->fp
->count
)
222 EXPORT_SYMBOL(__scm_send
);
224 int put_cmsg(struct msghdr
* msg
, int level
, int type
, int len
, void *data
)
226 struct cmsghdr __user
*cm
227 = (__force
struct cmsghdr __user
*)msg
->msg_control
;
228 struct cmsghdr cmhdr
;
229 int cmlen
= CMSG_LEN(len
);
232 if (MSG_CMSG_COMPAT
& msg
->msg_flags
)
233 return put_cmsg_compat(msg
, level
, type
, len
, data
);
235 if (cm
==NULL
|| msg
->msg_controllen
< sizeof(*cm
)) {
236 msg
->msg_flags
|= MSG_CTRUNC
;
237 return 0; /* XXX: return error? check spec. */
239 if (msg
->msg_controllen
< cmlen
) {
240 msg
->msg_flags
|= MSG_CTRUNC
;
241 cmlen
= msg
->msg_controllen
;
243 cmhdr
.cmsg_level
= level
;
244 cmhdr
.cmsg_type
= type
;
245 cmhdr
.cmsg_len
= cmlen
;
248 if (copy_to_user(cm
, &cmhdr
, sizeof cmhdr
))
250 if (copy_to_user(CMSG_DATA(cm
), data
, cmlen
- sizeof(struct cmsghdr
)))
252 cmlen
= CMSG_SPACE(len
);
253 if (msg
->msg_controllen
< cmlen
)
254 cmlen
= msg
->msg_controllen
;
255 msg
->msg_control
+= cmlen
;
256 msg
->msg_controllen
-= cmlen
;
261 EXPORT_SYMBOL(put_cmsg
);
263 void scm_detach_fds(struct msghdr
*msg
, struct scm_cookie
*scm
)
265 struct cmsghdr __user
*cm
266 = (__force
struct cmsghdr __user
*)msg
->msg_control
;
269 int fdnum
= scm
->fp
->count
;
270 struct file
**fp
= scm
->fp
->fp
;
274 if (MSG_CMSG_COMPAT
& msg
->msg_flags
) {
275 scm_detach_fds_compat(msg
, scm
);
279 if (msg
->msg_controllen
> sizeof(struct cmsghdr
))
280 fdmax
= ((msg
->msg_controllen
- sizeof(struct cmsghdr
))
286 for (i
=0, cmfptr
=(__force
int __user
*)CMSG_DATA(cm
); i
<fdmax
;
291 err
= security_file_receive(fp
[i
]);
294 err
= get_unused_fd_flags(MSG_CMSG_CLOEXEC
& msg
->msg_flags
299 err
= put_user(new_fd
, cmfptr
);
301 put_unused_fd(new_fd
);
304 /* Bump the usage count and install the file. */
305 sock
= sock_from_file(fp
[i
], &err
);
307 sock_update_netprioidx(sock
->sk
, current
);
308 sock_update_classid(sock
->sk
, current
);
310 fd_install(new_fd
, get_file(fp
[i
]));
315 int cmlen
= CMSG_LEN(i
*sizeof(int));
316 err
= put_user(SOL_SOCKET
, &cm
->cmsg_level
);
318 err
= put_user(SCM_RIGHTS
, &cm
->cmsg_type
);
320 err
= put_user(cmlen
, &cm
->cmsg_len
);
322 cmlen
= CMSG_SPACE(i
*sizeof(int));
323 msg
->msg_control
+= cmlen
;
324 msg
->msg_controllen
-= cmlen
;
327 if (i
< fdnum
|| (fdnum
&& fdmax
<= 0))
328 msg
->msg_flags
|= MSG_CTRUNC
;
331 * All of the files that fit in the message have had their
332 * usage counts incremented, so we just free the list.
336 EXPORT_SYMBOL(scm_detach_fds
);
338 struct scm_fp_list
*scm_fp_dup(struct scm_fp_list
*fpl
)
340 struct scm_fp_list
*new_fpl
;
346 new_fpl
= kmemdup(fpl
, offsetof(struct scm_fp_list
, fp
[fpl
->count
]),
349 for (i
= 0; i
< fpl
->count
; i
++)
350 get_file(fpl
->fp
[i
]);
351 new_fpl
->max
= new_fpl
->count
;
355 EXPORT_SYMBOL(scm_fp_dup
);