]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/blame - kernel/cred.c
userns: Use cred->user_ns instead of cred->user->user_ns
[mirror_ubuntu-zesty-kernel.git] / kernel / cred.c
CommitLineData
d410fa4e 1/* Task credentials management - see Documentation/security/credentials.txt
f1752eec
DH
2 *
3 * Copyright (C) 2008 Red Hat, Inc. All Rights Reserved.
4 * Written by David Howells (dhowells@redhat.com)
5 *
6 * This program is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU General Public Licence
8 * as published by the Free Software Foundation; either version
9 * 2 of the Licence, or (at your option) any later version.
10 */
9984de1a 11#include <linux/export.h>
f1752eec 12#include <linux/cred.h>
5a0e3ad6 13#include <linux/slab.h>
f1752eec
DH
14#include <linux/sched.h>
15#include <linux/key.h>
16#include <linux/keyctl.h>
17#include <linux/init_task.h>
18#include <linux/security.h>
40401530 19#include <linux/binfmts.h>
d84f4f99 20#include <linux/cn_proc.h>
d84f4f99 21
e0e81739
DH
22#if 0
23#define kdebug(FMT, ...) \
24 printk("[%-5.5s%5u] "FMT"\n", current->comm, current->pid ,##__VA_ARGS__)
25#else
e0e81739
DH
26#define kdebug(FMT, ...) \
27 no_printk("[%-5.5s%5u] "FMT"\n", current->comm, current->pid ,##__VA_ARGS__)
28#endif
29
d84f4f99 30static struct kmem_cache *cred_jar;
f1752eec 31
bb952bb9
DH
32/*
33 * The common credentials for the initial task's thread group
34 */
35#ifdef CONFIG_KEYS
36static struct thread_group_cred init_tgcred = {
37 .usage = ATOMIC_INIT(2),
38 .tgid = 0,
10389a15 39 .lock = __SPIN_LOCK_UNLOCKED(init_cred.tgcred.lock),
bb952bb9
DH
40};
41#endif
42
f1752eec
DH
43/*
44 * The initial credentials for the initial task
45 */
46struct cred init_cred = {
3b11a1de 47 .usage = ATOMIC_INIT(4),
e0e81739
DH
48#ifdef CONFIG_DEBUG_CREDENTIALS
49 .subscribers = ATOMIC_INIT(2),
50 .magic = CRED_MAGIC,
51#endif
f1752eec 52 .securebits = SECUREBITS_DEFAULT,
a3232d2f 53 .cap_inheritable = CAP_EMPTY_SET,
f1752eec 54 .cap_permitted = CAP_FULL_SET,
a3232d2f
EP
55 .cap_effective = CAP_FULL_SET,
56 .cap_bset = CAP_FULL_SET,
f1752eec 57 .user = INIT_USER,
47a150ed 58 .user_ns = &init_user_ns,
f1752eec 59 .group_info = &init_groups,
bb952bb9
DH
60#ifdef CONFIG_KEYS
61 .tgcred = &init_tgcred,
62#endif
f1752eec
DH
63};
64
e0e81739
DH
65static inline void set_cred_subscribers(struct cred *cred, int n)
66{
67#ifdef CONFIG_DEBUG_CREDENTIALS
68 atomic_set(&cred->subscribers, n);
69#endif
70}
71
72static inline int read_cred_subscribers(const struct cred *cred)
73{
74#ifdef CONFIG_DEBUG_CREDENTIALS
75 return atomic_read(&cred->subscribers);
76#else
77 return 0;
78#endif
79}
80
81static inline void alter_cred_subscribers(const struct cred *_cred, int n)
82{
83#ifdef CONFIG_DEBUG_CREDENTIALS
84 struct cred *cred = (struct cred *) _cred;
85
86 atomic_add(n, &cred->subscribers);
87#endif
88}
89
bb952bb9
DH
90/*
91 * Dispose of the shared task group credentials
92 */
93#ifdef CONFIG_KEYS
94static void release_tgcred_rcu(struct rcu_head *rcu)
95{
96 struct thread_group_cred *tgcred =
97 container_of(rcu, struct thread_group_cred, rcu);
98
99 BUG_ON(atomic_read(&tgcred->usage) != 0);
100
101 key_put(tgcred->session_keyring);
102 key_put(tgcred->process_keyring);
103 kfree(tgcred);
104}
105#endif
106
107/*
108 * Release a set of thread group credentials.
109 */
a6f76f23 110static void release_tgcred(struct cred *cred)
bb952bb9
DH
111{
112#ifdef CONFIG_KEYS
113 struct thread_group_cred *tgcred = cred->tgcred;
114
115 if (atomic_dec_and_test(&tgcred->usage))
116 call_rcu(&tgcred->rcu, release_tgcred_rcu);
117#endif
118}
119
f1752eec
DH
120/*
121 * The RCU callback to actually dispose of a set of credentials
122 */
123static void put_cred_rcu(struct rcu_head *rcu)
124{
125 struct cred *cred = container_of(rcu, struct cred, rcu);
126
e0e81739
DH
127 kdebug("put_cred_rcu(%p)", cred);
128
129#ifdef CONFIG_DEBUG_CREDENTIALS
130 if (cred->magic != CRED_MAGIC_DEAD ||
131 atomic_read(&cred->usage) != 0 ||
132 read_cred_subscribers(cred) != 0)
133 panic("CRED: put_cred_rcu() sees %p with"
134 " mag %x, put %p, usage %d, subscr %d\n",
135 cred, cred->magic, cred->put_addr,
136 atomic_read(&cred->usage),
137 read_cred_subscribers(cred));
138#else
d84f4f99
DH
139 if (atomic_read(&cred->usage) != 0)
140 panic("CRED: put_cred_rcu() sees %p with usage %d\n",
141 cred, atomic_read(&cred->usage));
e0e81739 142#endif
f1752eec 143
d84f4f99 144 security_cred_free(cred);
f1752eec
DH
145 key_put(cred->thread_keyring);
146 key_put(cred->request_key_auth);
bb952bb9 147 release_tgcred(cred);
4a5d6ba1
DH
148 if (cred->group_info)
149 put_group_info(cred->group_info);
f1752eec 150 free_uid(cred->user);
d84f4f99 151 kmem_cache_free(cred_jar, cred);
f1752eec
DH
152}
153
154/**
155 * __put_cred - Destroy a set of credentials
d84f4f99 156 * @cred: The record to release
f1752eec
DH
157 *
158 * Destroy a set of credentials on which no references remain.
159 */
160void __put_cred(struct cred *cred)
161{
e0e81739
DH
162 kdebug("__put_cred(%p{%d,%d})", cred,
163 atomic_read(&cred->usage),
164 read_cred_subscribers(cred));
165
d84f4f99 166 BUG_ON(atomic_read(&cred->usage) != 0);
e0e81739
DH
167#ifdef CONFIG_DEBUG_CREDENTIALS
168 BUG_ON(read_cred_subscribers(cred) != 0);
169 cred->magic = CRED_MAGIC_DEAD;
170 cred->put_addr = __builtin_return_address(0);
171#endif
172 BUG_ON(cred == current->cred);
173 BUG_ON(cred == current->real_cred);
d84f4f99 174
f1752eec
DH
175 call_rcu(&cred->rcu, put_cred_rcu);
176}
177EXPORT_SYMBOL(__put_cred);
178
e0e81739
DH
179/*
180 * Clean up a task's credentials when it exits
181 */
182void exit_creds(struct task_struct *tsk)
183{
184 struct cred *cred;
185
186 kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
187 atomic_read(&tsk->cred->usage),
188 read_cred_subscribers(tsk->cred));
189
190 cred = (struct cred *) tsk->real_cred;
191 tsk->real_cred = NULL;
192 validate_creds(cred);
193 alter_cred_subscribers(cred, -1);
194 put_cred(cred);
195
196 cred = (struct cred *) tsk->cred;
197 tsk->cred = NULL;
198 validate_creds(cred);
199 alter_cred_subscribers(cred, -1);
200 put_cred(cred);
ee18d64c
DH
201
202 cred = (struct cred *) tsk->replacement_session_keyring;
203 if (cred) {
204 tsk->replacement_session_keyring = NULL;
205 validate_creds(cred);
206 put_cred(cred);
207 }
208}
209
de09a977
DH
210/**
211 * get_task_cred - Get another task's objective credentials
212 * @task: The task to query
213 *
214 * Get the objective credentials of a task, pinning them so that they can't go
215 * away. Accessing a task's credentials directly is not permitted.
216 *
217 * The caller must also make sure task doesn't get deleted, either by holding a
218 * ref on task or by holding tasklist_lock to prevent it from being unlinked.
219 */
220const struct cred *get_task_cred(struct task_struct *task)
221{
222 const struct cred *cred;
223
224 rcu_read_lock();
225
226 do {
227 cred = __task_cred((task));
228 BUG_ON(!cred);
229 } while (!atomic_inc_not_zero(&((struct cred *)cred)->usage));
230
231 rcu_read_unlock();
232 return cred;
233}
234
ee18d64c
DH
235/*
236 * Allocate blank credentials, such that the credentials can be filled in at a
237 * later date without risk of ENOMEM.
238 */
239struct cred *cred_alloc_blank(void)
240{
241 struct cred *new;
242
243 new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
244 if (!new)
245 return NULL;
246
247#ifdef CONFIG_KEYS
248 new->tgcred = kzalloc(sizeof(*new->tgcred), GFP_KERNEL);
249 if (!new->tgcred) {
b8a1d37c 250 kmem_cache_free(cred_jar, new);
ee18d64c
DH
251 return NULL;
252 }
253 atomic_set(&new->tgcred->usage, 1);
254#endif
255
256 atomic_set(&new->usage, 1);
2edeaa34
TH
257#ifdef CONFIG_DEBUG_CREDENTIALS
258 new->magic = CRED_MAGIC;
259#endif
ee18d64c
DH
260
261 if (security_cred_alloc_blank(new, GFP_KERNEL) < 0)
262 goto error;
263
ee18d64c
DH
264 return new;
265
266error:
267 abort_creds(new);
268 return NULL;
e0e81739
DH
269}
270
d84f4f99
DH
271/**
272 * prepare_creds - Prepare a new set of credentials for modification
273 *
274 * Prepare a new set of task credentials for modification. A task's creds
275 * shouldn't generally be modified directly, therefore this function is used to
276 * prepare a new copy, which the caller then modifies and then commits by
277 * calling commit_creds().
278 *
3b11a1de
DH
279 * Preparation involves making a copy of the objective creds for modification.
280 *
d84f4f99
DH
281 * Returns a pointer to the new creds-to-be if successful, NULL otherwise.
282 *
283 * Call commit_creds() or abort_creds() to clean up.
284 */
285struct cred *prepare_creds(void)
286{
287 struct task_struct *task = current;
288 const struct cred *old;
289 struct cred *new;
290
e0e81739 291 validate_process_creds();
d84f4f99
DH
292
293 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
294 if (!new)
295 return NULL;
296
e0e81739
DH
297 kdebug("prepare_creds() alloc %p", new);
298
d84f4f99
DH
299 old = task->cred;
300 memcpy(new, old, sizeof(struct cred));
301
302 atomic_set(&new->usage, 1);
e0e81739 303 set_cred_subscribers(new, 0);
d84f4f99
DH
304 get_group_info(new->group_info);
305 get_uid(new->user);
306
307#ifdef CONFIG_KEYS
308 key_get(new->thread_keyring);
309 key_get(new->request_key_auth);
310 atomic_inc(&new->tgcred->usage);
311#endif
312
313#ifdef CONFIG_SECURITY
314 new->security = NULL;
315#endif
316
317 if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
318 goto error;
e0e81739 319 validate_creds(new);
d84f4f99
DH
320 return new;
321
322error:
323 abort_creds(new);
324 return NULL;
325}
326EXPORT_SYMBOL(prepare_creds);
327
a6f76f23
DH
328/*
329 * Prepare credentials for current to perform an execve()
9b1bf12d 330 * - The caller must hold ->cred_guard_mutex
a6f76f23
DH
331 */
332struct cred *prepare_exec_creds(void)
333{
334 struct thread_group_cred *tgcred = NULL;
335 struct cred *new;
336
337#ifdef CONFIG_KEYS
338 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
339 if (!tgcred)
340 return NULL;
341#endif
342
343 new = prepare_creds();
344 if (!new) {
345 kfree(tgcred);
346 return new;
347 }
348
349#ifdef CONFIG_KEYS
350 /* newly exec'd tasks don't get a thread keyring */
351 key_put(new->thread_keyring);
352 new->thread_keyring = NULL;
353
354 /* create a new per-thread-group creds for all this set of threads to
355 * share */
356 memcpy(tgcred, new->tgcred, sizeof(struct thread_group_cred));
357
358 atomic_set(&tgcred->usage, 1);
359 spin_lock_init(&tgcred->lock);
360
361 /* inherit the session keyring; new process keyring */
362 key_get(tgcred->session_keyring);
363 tgcred->process_keyring = NULL;
364
365 release_tgcred(new);
366 new->tgcred = tgcred;
367#endif
368
369 return new;
370}
371
f1752eec
DH
372/*
373 * Copy credentials for the new process created by fork()
d84f4f99
DH
374 *
375 * We share if we can, but under some circumstances we have to generate a new
376 * set.
3b11a1de
DH
377 *
378 * The new process gets the current process's subjective credentials as its
379 * objective and subjective credentials
f1752eec
DH
380 */
381int copy_creds(struct task_struct *p, unsigned long clone_flags)
382{
d84f4f99
DH
383#ifdef CONFIG_KEYS
384 struct thread_group_cred *tgcred;
385#endif
386 struct cred *new;
18b6e041 387 int ret;
d84f4f99 388
d84f4f99
DH
389 if (
390#ifdef CONFIG_KEYS
391 !p->cred->thread_keyring &&
392#endif
393 clone_flags & CLONE_THREAD
394 ) {
3b11a1de 395 p->real_cred = get_cred(p->cred);
d84f4f99 396 get_cred(p->cred);
e0e81739
DH
397 alter_cred_subscribers(p->cred, 2);
398 kdebug("share_creds(%p{%d,%d})",
399 p->cred, atomic_read(&p->cred->usage),
400 read_cred_subscribers(p->cred));
d84f4f99
DH
401 atomic_inc(&p->cred->user->processes);
402 return 0;
403 }
404
405 new = prepare_creds();
406 if (!new)
f1752eec
DH
407 return -ENOMEM;
408
18b6e041
SH
409 if (clone_flags & CLONE_NEWUSER) {
410 ret = create_user_ns(new);
411 if (ret < 0)
412 goto error_put;
413 }
414
47a150ed
SH
415 /* cache user_ns in cred. Doesn't need a refcount because it will
416 * stay pinned by cred->user
417 */
418 new->user_ns = new->user->user_ns;
419
bb952bb9 420#ifdef CONFIG_KEYS
d84f4f99
DH
421 /* new threads get their own thread keyrings if their parent already
422 * had one */
423 if (new->thread_keyring) {
424 key_put(new->thread_keyring);
425 new->thread_keyring = NULL;
426 if (clone_flags & CLONE_THREAD)
427 install_thread_keyring_to_cred(new);
428 }
429
430 /* we share the process and session keyrings between all the threads in
431 * a process - this is slightly icky as we violate COW credentials a
432 * bit */
433 if (!(clone_flags & CLONE_THREAD)) {
434 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
435 if (!tgcred) {
18b6e041
SH
436 ret = -ENOMEM;
437 goto error_put;
bb952bb9 438 }
d84f4f99
DH
439 atomic_set(&tgcred->usage, 1);
440 spin_lock_init(&tgcred->lock);
441 tgcred->process_keyring = NULL;
442 tgcred->session_keyring = key_get(new->tgcred->session_keyring);
443
444 release_tgcred(new);
445 new->tgcred = tgcred;
bb952bb9
DH
446 }
447#endif
448
d84f4f99 449 atomic_inc(&new->user->processes);
3b11a1de 450 p->cred = p->real_cred = get_cred(new);
e0e81739
DH
451 alter_cred_subscribers(new, 2);
452 validate_creds(new);
d84f4f99 453 return 0;
18b6e041
SH
454
455error_put:
456 put_cred(new);
457 return ret;
d84f4f99 458}
f1752eec 459
d84f4f99
DH
460/**
461 * commit_creds - Install new credentials upon the current task
462 * @new: The credentials to be assigned
463 *
464 * Install a new set of credentials to the current task, using RCU to replace
3b11a1de
DH
465 * the old set. Both the objective and the subjective credentials pointers are
466 * updated. This function may not be called if the subjective credentials are
467 * in an overridden state.
d84f4f99
DH
468 *
469 * This function eats the caller's reference to the new credentials.
470 *
471 * Always returns 0 thus allowing this function to be tail-called at the end
472 * of, say, sys_setgid().
473 */
474int commit_creds(struct cred *new)
475{
476 struct task_struct *task = current;
e0e81739 477 const struct cred *old = task->real_cred;
d84f4f99 478
e0e81739
DH
479 kdebug("commit_creds(%p{%d,%d})", new,
480 atomic_read(&new->usage),
481 read_cred_subscribers(new));
482
483 BUG_ON(task->cred != old);
484#ifdef CONFIG_DEBUG_CREDENTIALS
485 BUG_ON(read_cred_subscribers(old) < 2);
486 validate_creds(old);
487 validate_creds(new);
488#endif
d84f4f99 489 BUG_ON(atomic_read(&new->usage) < 1);
d84f4f99 490
3b11a1de
DH
491 get_cred(new); /* we will require a ref for the subj creds too */
492
d84f4f99
DH
493 /* dumpability changes */
494 if (old->euid != new->euid ||
495 old->egid != new->egid ||
496 old->fsuid != new->fsuid ||
497 old->fsgid != new->fsgid ||
498 !cap_issubset(new->cap_permitted, old->cap_permitted)) {
b9456371
DH
499 if (task->mm)
500 set_dumpable(task->mm, suid_dumpable);
d84f4f99
DH
501 task->pdeath_signal = 0;
502 smp_wmb();
f1752eec
DH
503 }
504
d84f4f99
DH
505 /* alter the thread keyring */
506 if (new->fsuid != old->fsuid)
507 key_fsuid_changed(task);
508 if (new->fsgid != old->fsgid)
509 key_fsgid_changed(task);
510
511 /* do it
72fa5997
VK
512 * RLIMIT_NPROC limits on user->processes have already been checked
513 * in set_user().
d84f4f99 514 */
e0e81739 515 alter_cred_subscribers(new, 2);
d84f4f99
DH
516 if (new->user != old->user)
517 atomic_inc(&new->user->processes);
3b11a1de 518 rcu_assign_pointer(task->real_cred, new);
d84f4f99
DH
519 rcu_assign_pointer(task->cred, new);
520 if (new->user != old->user)
521 atomic_dec(&old->user->processes);
e0e81739 522 alter_cred_subscribers(old, -2);
d84f4f99 523
d84f4f99
DH
524 /* send notifications */
525 if (new->uid != old->uid ||
526 new->euid != old->euid ||
527 new->suid != old->suid ||
528 new->fsuid != old->fsuid)
529 proc_id_connector(task, PROC_EVENT_UID);
f1752eec 530
d84f4f99
DH
531 if (new->gid != old->gid ||
532 new->egid != old->egid ||
533 new->sgid != old->sgid ||
534 new->fsgid != old->fsgid)
535 proc_id_connector(task, PROC_EVENT_GID);
f1752eec 536
3b11a1de
DH
537 /* release the old obj and subj refs both */
538 put_cred(old);
d84f4f99 539 put_cred(old);
f1752eec
DH
540 return 0;
541}
d84f4f99
DH
542EXPORT_SYMBOL(commit_creds);
543
544/**
545 * abort_creds - Discard a set of credentials and unlock the current task
546 * @new: The credentials that were going to be applied
547 *
548 * Discard a set of credentials that were under construction and unlock the
549 * current task.
550 */
551void abort_creds(struct cred *new)
552{
e0e81739
DH
553 kdebug("abort_creds(%p{%d,%d})", new,
554 atomic_read(&new->usage),
555 read_cred_subscribers(new));
556
557#ifdef CONFIG_DEBUG_CREDENTIALS
558 BUG_ON(read_cred_subscribers(new) != 0);
559#endif
d84f4f99
DH
560 BUG_ON(atomic_read(&new->usage) < 1);
561 put_cred(new);
562}
563EXPORT_SYMBOL(abort_creds);
564
565/**
3b11a1de 566 * override_creds - Override the current process's subjective credentials
d84f4f99
DH
567 * @new: The credentials to be assigned
568 *
3b11a1de
DH
569 * Install a set of temporary override subjective credentials on the current
570 * process, returning the old set for later reversion.
d84f4f99
DH
571 */
572const struct cred *override_creds(const struct cred *new)
573{
574 const struct cred *old = current->cred;
575
e0e81739
DH
576 kdebug("override_creds(%p{%d,%d})", new,
577 atomic_read(&new->usage),
578 read_cred_subscribers(new));
579
580 validate_creds(old);
581 validate_creds(new);
582 get_cred(new);
583 alter_cred_subscribers(new, 1);
584 rcu_assign_pointer(current->cred, new);
585 alter_cred_subscribers(old, -1);
586
587 kdebug("override_creds() = %p{%d,%d}", old,
588 atomic_read(&old->usage),
589 read_cred_subscribers(old));
d84f4f99
DH
590 return old;
591}
592EXPORT_SYMBOL(override_creds);
593
594/**
3b11a1de 595 * revert_creds - Revert a temporary subjective credentials override
d84f4f99
DH
596 * @old: The credentials to be restored
597 *
3b11a1de
DH
598 * Revert a temporary set of override subjective credentials to an old set,
599 * discarding the override set.
d84f4f99
DH
600 */
601void revert_creds(const struct cred *old)
602{
603 const struct cred *override = current->cred;
604
e0e81739
DH
605 kdebug("revert_creds(%p{%d,%d})", old,
606 atomic_read(&old->usage),
607 read_cred_subscribers(old));
608
609 validate_creds(old);
610 validate_creds(override);
611 alter_cred_subscribers(old, 1);
d84f4f99 612 rcu_assign_pointer(current->cred, old);
e0e81739 613 alter_cred_subscribers(override, -1);
d84f4f99
DH
614 put_cred(override);
615}
616EXPORT_SYMBOL(revert_creds);
617
618/*
619 * initialise the credentials stuff
620 */
621void __init cred_init(void)
622{
623 /* allocate a slab in which we can store credentials */
624 cred_jar = kmem_cache_create("cred_jar", sizeof(struct cred),
625 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
626}
3a3b7ce9
DH
627
628/**
629 * prepare_kernel_cred - Prepare a set of credentials for a kernel service
630 * @daemon: A userspace daemon to be used as a reference
631 *
632 * Prepare a set of credentials for a kernel service. This can then be used to
633 * override a task's own credentials so that work can be done on behalf of that
634 * task that requires a different subjective context.
635 *
636 * @daemon is used to provide a base for the security record, but can be NULL.
637 * If @daemon is supplied, then the security data will be derived from that;
638 * otherwise they'll be set to 0 and no groups, full capabilities and no keys.
639 *
640 * The caller may change these controls afterwards if desired.
641 *
642 * Returns the new credentials or NULL if out of memory.
643 *
644 * Does not take, and does not return holding current->cred_replace_mutex.
645 */
646struct cred *prepare_kernel_cred(struct task_struct *daemon)
647{
012146d0
DH
648#ifdef CONFIG_KEYS
649 struct thread_group_cred *tgcred;
650#endif
3a3b7ce9
DH
651 const struct cred *old;
652 struct cred *new;
653
654 new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
655 if (!new)
656 return NULL;
657
8ad346c6 658#ifdef CONFIG_KEYS
012146d0
DH
659 tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
660 if (!tgcred) {
661 kmem_cache_free(cred_jar, new);
662 return NULL;
663 }
8ad346c6 664#endif
012146d0 665
e0e81739
DH
666 kdebug("prepare_kernel_cred() alloc %p", new);
667
3a3b7ce9
DH
668 if (daemon)
669 old = get_task_cred(daemon);
670 else
671 old = get_cred(&init_cred);
672
e0e81739
DH
673 validate_creds(old);
674
43529c97 675 *new = *old;
fb2b2a1d
TH
676 atomic_set(&new->usage, 1);
677 set_cred_subscribers(new, 0);
3a3b7ce9
DH
678 get_uid(new->user);
679 get_group_info(new->group_info);
680
681#ifdef CONFIG_KEYS
012146d0
DH
682 atomic_set(&tgcred->usage, 1);
683 spin_lock_init(&tgcred->lock);
684 tgcred->process_keyring = NULL;
685 tgcred->session_keyring = NULL;
686 new->tgcred = tgcred;
3a3b7ce9
DH
687 new->request_key_auth = NULL;
688 new->thread_keyring = NULL;
689 new->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;
690#endif
691
692#ifdef CONFIG_SECURITY
693 new->security = NULL;
694#endif
695 if (security_prepare_creds(new, old, GFP_KERNEL) < 0)
696 goto error;
697
3a3b7ce9 698 put_cred(old);
e0e81739 699 validate_creds(new);
3a3b7ce9
DH
700 return new;
701
702error:
703 put_cred(new);
0de33681 704 put_cred(old);
3a3b7ce9
DH
705 return NULL;
706}
707EXPORT_SYMBOL(prepare_kernel_cred);
708
709/**
710 * set_security_override - Set the security ID in a set of credentials
711 * @new: The credentials to alter
712 * @secid: The LSM security ID to set
713 *
714 * Set the LSM security ID in a set of credentials so that the subjective
715 * security is overridden when an alternative set of credentials is used.
716 */
717int set_security_override(struct cred *new, u32 secid)
718{
719 return security_kernel_act_as(new, secid);
720}
721EXPORT_SYMBOL(set_security_override);
722
723/**
724 * set_security_override_from_ctx - Set the security ID in a set of credentials
725 * @new: The credentials to alter
726 * @secctx: The LSM security context to generate the security ID from.
727 *
728 * Set the LSM security ID in a set of credentials so that the subjective
729 * security is overridden when an alternative set of credentials is used. The
730 * security ID is specified in string form as a security context to be
731 * interpreted by the LSM.
732 */
733int set_security_override_from_ctx(struct cred *new, const char *secctx)
734{
735 u32 secid;
736 int ret;
737
738 ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
739 if (ret < 0)
740 return ret;
741
742 return set_security_override(new, secid);
743}
744EXPORT_SYMBOL(set_security_override_from_ctx);
745
746/**
747 * set_create_files_as - Set the LSM file create context in a set of credentials
748 * @new: The credentials to alter
749 * @inode: The inode to take the context from
750 *
751 * Change the LSM file creation context in a set of credentials to be the same
752 * as the object context of the specified inode, so that the new inodes have
753 * the same MAC context as that inode.
754 */
755int set_create_files_as(struct cred *new, struct inode *inode)
756{
757 new->fsuid = inode->i_uid;
758 new->fsgid = inode->i_gid;
759 return security_kernel_create_files_as(new, inode);
760}
761EXPORT_SYMBOL(set_create_files_as);
e0e81739
DH
762
763#ifdef CONFIG_DEBUG_CREDENTIALS
764
74908a00
AM
765bool creds_are_invalid(const struct cred *cred)
766{
767 if (cred->magic != CRED_MAGIC)
768 return true;
74908a00 769#ifdef CONFIG_SECURITY_SELINUX
2edeaa34
TH
770 /*
771 * cred->security == NULL if security_cred_alloc_blank() or
772 * security_prepare_creds() returned an error.
773 */
774 if (selinux_is_enabled() && cred->security) {
74908a00
AM
775 if ((unsigned long) cred->security < PAGE_SIZE)
776 return true;
777 if ((*(u32 *)cred->security & 0xffffff00) ==
778 (POISON_FREE << 24 | POISON_FREE << 16 | POISON_FREE << 8))
779 return true;
780 }
781#endif
782 return false;
783}
764db03f 784EXPORT_SYMBOL(creds_are_invalid);
74908a00 785
e0e81739
DH
786/*
787 * dump invalid credentials
788 */
789static void dump_invalid_creds(const struct cred *cred, const char *label,
790 const struct task_struct *tsk)
791{
792 printk(KERN_ERR "CRED: %s credentials: %p %s%s%s\n",
793 label, cred,
794 cred == &init_cred ? "[init]" : "",
795 cred == tsk->real_cred ? "[real]" : "",
796 cred == tsk->cred ? "[eff]" : "");
797 printk(KERN_ERR "CRED: ->magic=%x, put_addr=%p\n",
798 cred->magic, cred->put_addr);
799 printk(KERN_ERR "CRED: ->usage=%d, subscr=%d\n",
800 atomic_read(&cred->usage),
801 read_cred_subscribers(cred));
802 printk(KERN_ERR "CRED: ->*uid = { %d,%d,%d,%d }\n",
803 cred->uid, cred->euid, cred->suid, cred->fsuid);
804 printk(KERN_ERR "CRED: ->*gid = { %d,%d,%d,%d }\n",
805 cred->gid, cred->egid, cred->sgid, cred->fsgid);
806#ifdef CONFIG_SECURITY
807 printk(KERN_ERR "CRED: ->security is %p\n", cred->security);
808 if ((unsigned long) cred->security >= PAGE_SIZE &&
809 (((unsigned long) cred->security & 0xffffff00) !=
810 (POISON_FREE << 24 | POISON_FREE << 16 | POISON_FREE << 8)))
811 printk(KERN_ERR "CRED: ->security {%x, %x}\n",
812 ((u32*)cred->security)[0],
813 ((u32*)cred->security)[1]);
814#endif
815}
816
817/*
818 * report use of invalid credentials
819 */
820void __invalid_creds(const struct cred *cred, const char *file, unsigned line)
821{
822 printk(KERN_ERR "CRED: Invalid credentials\n");
823 printk(KERN_ERR "CRED: At %s:%u\n", file, line);
824 dump_invalid_creds(cred, "Specified", current);
825 BUG();
826}
827EXPORT_SYMBOL(__invalid_creds);
828
829/*
830 * check the credentials on a process
831 */
832void __validate_process_creds(struct task_struct *tsk,
833 const char *file, unsigned line)
834{
835 if (tsk->cred == tsk->real_cred) {
836 if (unlikely(read_cred_subscribers(tsk->cred) < 2 ||
837 creds_are_invalid(tsk->cred)))
838 goto invalid_creds;
839 } else {
840 if (unlikely(read_cred_subscribers(tsk->real_cred) < 1 ||
841 read_cred_subscribers(tsk->cred) < 1 ||
842 creds_are_invalid(tsk->real_cred) ||
843 creds_are_invalid(tsk->cred)))
844 goto invalid_creds;
845 }
846 return;
847
848invalid_creds:
849 printk(KERN_ERR "CRED: Invalid process credentials\n");
850 printk(KERN_ERR "CRED: At %s:%u\n", file, line);
851
852 dump_invalid_creds(tsk->real_cred, "Real", tsk);
853 if (tsk->cred != tsk->real_cred)
854 dump_invalid_creds(tsk->cred, "Effective", tsk);
855 else
856 printk(KERN_ERR "CRED: Effective creds == Real creds\n");
857 BUG();
858}
859EXPORT_SYMBOL(__validate_process_creds);
860
861/*
862 * check creds for do_exit()
863 */
864void validate_creds_for_do_exit(struct task_struct *tsk)
865{
866 kdebug("validate_creds_for_do_exit(%p,%p{%d,%d})",
867 tsk->real_cred, tsk->cred,
868 atomic_read(&tsk->cred->usage),
869 read_cred_subscribers(tsk->cred));
870
871 __validate_process_creds(tsk, __FILE__, __LINE__);
872}
873
874#endif /* CONFIG_DEBUG_CREDENTIALS */