]>
Commit | Line | Data |
---|---|---|
b2441318 | 1 | /* SPDX-License-Identifier: GPL-2.0 */ |
1da177e4 LT |
2 | #ifndef __LINUX_NET_SCM_H |
3 | #define __LINUX_NET_SCM_H | |
4 | ||
5 | #include <linux/limits.h> | |
6 | #include <linux/net.h> | |
5b825c3a | 7 | #include <linux/cred.h> |
dc49c1f9 | 8 | #include <linux/security.h> |
b488893a PE |
9 | #include <linux/pid.h> |
10 | #include <linux/nsproxy.h> | |
7a36094d | 11 | #include <linux/sched/signal.h> |
1da177e4 LT |
12 | |
13 | /* Well, we should have at least one descriptor open | |
14 | * to accept passed FDs 8) | |
15 | */ | |
bba14de9 | 16 | #define SCM_MAX_FD 253 |
1da177e4 | 17 | |
dbe9a417 EB |
18 | struct scm_creds { |
19 | u32 pid; | |
20 | kuid_t uid; | |
21 | kgid_t gid; | |
22 | }; | |
23 | ||
fd2c3ef7 | 24 | struct scm_fp_list { |
bba14de9 ED |
25 | short count; |
26 | short max; | |
415e3d3e | 27 | struct user_struct *user; |
f8d570a4 | 28 | struct file *fp[SCM_MAX_FD]; |
1da177e4 LT |
29 | }; |
30 | ||
fd2c3ef7 | 31 | struct scm_cookie { |
257b5358 | 32 | struct pid *pid; /* Skb credentials */ |
1da177e4 | 33 | struct scm_fp_list *fp; /* Passed files */ |
dbe9a417 | 34 | struct scm_creds creds; /* Skb credentials */ |
877ce7c1 | 35 | #ifdef CONFIG_SECURITY_NETWORK |
dc49c1f9 | 36 | u32 secid; /* Passed security ID */ |
877ce7c1 | 37 | #endif |
1da177e4 LT |
38 | }; |
39 | ||
c0029de5 | 40 | int __scm_install_fd(struct file *file, int __user *ufd, unsigned int o_flags); |
8153ff5c JP |
41 | void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm); |
42 | void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm); | |
43 | int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm); | |
44 | void __scm_destroy(struct scm_cookie *scm); | |
45 | struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl); | |
1da177e4 | 46 | |
dc49c1f9 CZ |
47 | #ifdef CONFIG_SECURITY_NETWORK |
48 | static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm) | |
49 | { | |
50 | security_socket_getpeersec_dgram(sock, NULL, &scm->secid); | |
51 | } | |
52 | #else | |
53 | static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm) | |
54 | { } | |
55 | #endif /* CONFIG_SECURITY_NETWORK */ | |
56 | ||
257b5358 | 57 | static __inline__ void scm_set_cred(struct scm_cookie *scm, |
6b0ee8c0 | 58 | struct pid *pid, kuid_t uid, kgid_t gid) |
257b5358 EB |
59 | { |
60 | scm->pid = get_pid(pid); | |
dbe9a417 | 61 | scm->creds.pid = pid_vnr(pid); |
6b0ee8c0 EB |
62 | scm->creds.uid = uid; |
63 | scm->creds.gid = gid; | |
257b5358 EB |
64 | } |
65 | ||
66 | static __inline__ void scm_destroy_cred(struct scm_cookie *scm) | |
67 | { | |
68 | put_pid(scm->pid); | |
69 | scm->pid = NULL; | |
257b5358 EB |
70 | } |
71 | ||
1da177e4 LT |
72 | static __inline__ void scm_destroy(struct scm_cookie *scm) |
73 | { | |
257b5358 | 74 | scm_destroy_cred(scm); |
2a6c8c79 | 75 | if (scm->fp) |
1da177e4 LT |
76 | __scm_destroy(scm); |
77 | } | |
78 | ||
79 | static __inline__ int scm_send(struct socket *sock, struct msghdr *msg, | |
e0e3cea4 | 80 | struct scm_cookie *scm, bool forcecreds) |
1da177e4 | 81 | { |
16e57262 | 82 | memset(scm, 0, sizeof(*scm)); |
6b0ee8c0 EB |
83 | scm->creds.uid = INVALID_UID; |
84 | scm->creds.gid = INVALID_GID; | |
e0e3cea4 | 85 | if (forcecreds) |
6e0895c2 | 86 | scm_set_cred(scm, task_tgid(current), current_uid(), current_gid()); |
dc49c1f9 | 87 | unix_get_peersec_dgram(sock, scm); |
1da177e4 LT |
88 | if (msg->msg_controllen <= 0) |
89 | return 0; | |
90 | return __scm_send(sock, msg, scm); | |
91 | } | |
92 | ||
877ce7c1 CZ |
93 | #ifdef CONFIG_SECURITY_NETWORK |
94 | static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm) | |
95 | { | |
dc49c1f9 CZ |
96 | char *secdata; |
97 | u32 seclen; | |
98 | int err; | |
99 | ||
100 | if (test_bit(SOCK_PASSSEC, &sock->flags)) { | |
101 | err = security_secid_to_secctx(scm->secid, &secdata, &seclen); | |
102 | ||
103 | if (!err) { | |
104 | put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, seclen, secdata); | |
105 | security_release_secctx(secdata, seclen); | |
106 | } | |
107 | } | |
877ce7c1 CZ |
108 | } |
109 | #else | |
110 | static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm) | |
111 | { } | |
112 | #endif /* CONFIG_SECURITY_NETWORK */ | |
113 | ||
1da177e4 LT |
114 | static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg, |
115 | struct scm_cookie *scm, int flags) | |
116 | { | |
fd2c3ef7 | 117 | if (!msg->msg_control) { |
1da177e4 LT |
118 | if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp) |
119 | msg->msg_flags |= MSG_CTRUNC; | |
f78a5fda | 120 | scm_destroy(scm); |
1da177e4 LT |
121 | return; |
122 | } | |
123 | ||
dbe9a417 EB |
124 | if (test_bit(SOCK_PASSCRED, &sock->flags)) { |
125 | struct user_namespace *current_ns = current_user_ns(); | |
126 | struct ucred ucreds = { | |
127 | .pid = scm->creds.pid, | |
128 | .uid = from_kuid_munged(current_ns, scm->creds.uid), | |
129 | .gid = from_kgid_munged(current_ns, scm->creds.gid), | |
130 | }; | |
131 | put_cmsg(msg, SOL_SOCKET, SCM_CREDENTIALS, sizeof(ucreds), &ucreds); | |
132 | } | |
1da177e4 | 133 | |
f78a5fda DM |
134 | scm_destroy_cred(scm); |
135 | ||
877ce7c1 CZ |
136 | scm_passec(sock, msg, scm); |
137 | ||
1da177e4 LT |
138 | if (!scm->fp) |
139 | return; | |
140 | ||
141 | scm_detach_fds(msg, scm); | |
142 | } | |
143 | ||
144 | ||
145 | #endif /* __LINUX_NET_SCM_H */ | |
146 |