Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | #ifndef __LINUX_NET_SCM_H |
| 2 | #define __LINUX_NET_SCM_H |
| 3 | |
| 4 | #include <linux/limits.h> |
| 5 | #include <linux/net.h> |
Catherine Zhang | dc49c1f | 2006-08-02 14:12:06 -0700 | [diff] [blame] | 6 | #include <linux/security.h> |
Pavel Emelyanov | b488893 | 2007-10-18 23:40:14 -0700 | [diff] [blame] | 7 | #include <linux/pid.h> |
| 8 | #include <linux/nsproxy.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 9 | |
| 10 | /* Well, we should have at least one descriptor open |
| 11 | * to accept passed FDs 8) |
| 12 | */ |
Eric Dumazet | bba14de | 2010-11-23 14:09:15 +0000 | [diff] [blame] | 13 | #define SCM_MAX_FD 253 |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 14 | |
Eric W. Biederman | dbe9a41 | 2012-09-06 18:20:01 +0000 | [diff] [blame] | 15 | struct scm_creds { |
| 16 | u32 pid; |
| 17 | kuid_t uid; |
| 18 | kgid_t gid; |
| 19 | }; |
| 20 | |
Eric Dumazet | fd2c3ef | 2009-11-03 03:26:03 +0000 | [diff] [blame] | 21 | struct scm_fp_list { |
Eric Dumazet | bba14de | 2010-11-23 14:09:15 +0000 | [diff] [blame] | 22 | short count; |
| 23 | short max; |
David Miller | f8d570a | 2008-11-06 00:37:40 -0800 | [diff] [blame] | 24 | struct file *fp[SCM_MAX_FD]; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 25 | }; |
| 26 | |
Eric Dumazet | fd2c3ef | 2009-11-03 03:26:03 +0000 | [diff] [blame] | 27 | struct scm_cookie { |
Eric W. Biederman | 257b535 | 2010-06-13 03:32:34 +0000 | [diff] [blame] | 28 | struct pid *pid; /* Skb credentials */ |
| 29 | const struct cred *cred; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 30 | struct scm_fp_list *fp; /* Passed files */ |
Eric W. Biederman | dbe9a41 | 2012-09-06 18:20:01 +0000 | [diff] [blame] | 31 | struct scm_creds creds; /* Skb credentials */ |
Catherine Zhang | 877ce7c | 2006-06-29 12:27:47 -0700 | [diff] [blame] | 32 | #ifdef CONFIG_SECURITY_NETWORK |
Catherine Zhang | dc49c1f | 2006-08-02 14:12:06 -0700 | [diff] [blame] | 33 | u32 secid; /* Passed security ID */ |
Catherine Zhang | 877ce7c | 2006-06-29 12:27:47 -0700 | [diff] [blame] | 34 | #endif |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 35 | }; |
| 36 | |
| 37 | extern void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm); |
| 38 | extern void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm); |
| 39 | extern int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm); |
| 40 | extern void __scm_destroy(struct scm_cookie *scm); |
| 41 | extern struct scm_fp_list * scm_fp_dup(struct scm_fp_list *fpl); |
| 42 | |
Catherine Zhang | dc49c1f | 2006-08-02 14:12:06 -0700 | [diff] [blame] | 43 | #ifdef CONFIG_SECURITY_NETWORK |
| 44 | static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm) |
| 45 | { |
| 46 | security_socket_getpeersec_dgram(sock, NULL, &scm->secid); |
| 47 | } |
| 48 | #else |
| 49 | static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm) |
| 50 | { } |
| 51 | #endif /* CONFIG_SECURITY_NETWORK */ |
| 52 | |
Eric W. Biederman | 257b535 | 2010-06-13 03:32:34 +0000 | [diff] [blame] | 53 | static __inline__ void scm_set_cred(struct scm_cookie *scm, |
| 54 | struct pid *pid, const struct cred *cred) |
| 55 | { |
| 56 | scm->pid = get_pid(pid); |
Eric Dumazet | 16e5726 | 2011-09-19 05:52:27 +0000 | [diff] [blame] | 57 | scm->cred = cred ? get_cred(cred) : NULL; |
Eric W. Biederman | dbe9a41 | 2012-09-06 18:20:01 +0000 | [diff] [blame] | 58 | scm->creds.pid = pid_vnr(pid); |
| 59 | scm->creds.uid = cred ? cred->euid : INVALID_UID; |
| 60 | scm->creds.gid = cred ? cred->egid : INVALID_GID; |
Eric W. Biederman | 257b535 | 2010-06-13 03:32:34 +0000 | [diff] [blame] | 61 | } |
| 62 | |
| 63 | static __inline__ void scm_destroy_cred(struct scm_cookie *scm) |
| 64 | { |
| 65 | put_pid(scm->pid); |
| 66 | scm->pid = NULL; |
| 67 | |
| 68 | if (scm->cred) |
| 69 | put_cred(scm->cred); |
| 70 | scm->cred = NULL; |
| 71 | } |
| 72 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 73 | static __inline__ void scm_destroy(struct scm_cookie *scm) |
| 74 | { |
Eric W. Biederman | 257b535 | 2010-06-13 03:32:34 +0000 | [diff] [blame] | 75 | scm_destroy_cred(scm); |
David S. Miller | 2a6c8c7 | 2012-09-24 15:52:33 -0400 | [diff] [blame] | 76 | if (scm->fp) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 77 | __scm_destroy(scm); |
| 78 | } |
| 79 | |
| 80 | static __inline__ int scm_send(struct socket *sock, struct msghdr *msg, |
Eric Dumazet | e0e3cea | 2012-08-21 06:21:17 +0000 | [diff] [blame] | 81 | struct scm_cookie *scm, bool forcecreds) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 82 | { |
Eric Dumazet | 16e5726 | 2011-09-19 05:52:27 +0000 | [diff] [blame] | 83 | memset(scm, 0, sizeof(*scm)); |
Eric Dumazet | e0e3cea | 2012-08-21 06:21:17 +0000 | [diff] [blame] | 84 | if (forcecreds) |
| 85 | scm_set_cred(scm, task_tgid(current), current_cred()); |
Catherine Zhang | dc49c1f | 2006-08-02 14:12:06 -0700 | [diff] [blame] | 86 | unix_get_peersec_dgram(sock, scm); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 87 | if (msg->msg_controllen <= 0) |
| 88 | return 0; |
| 89 | return __scm_send(sock, msg, scm); |
| 90 | } |
| 91 | |
Catherine Zhang | 877ce7c | 2006-06-29 12:27:47 -0700 | [diff] [blame] | 92 | #ifdef CONFIG_SECURITY_NETWORK |
| 93 | static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm) |
| 94 | { |
Catherine Zhang | dc49c1f | 2006-08-02 14:12:06 -0700 | [diff] [blame] | 95 | char *secdata; |
| 96 | u32 seclen; |
| 97 | int err; |
| 98 | |
| 99 | if (test_bit(SOCK_PASSSEC, &sock->flags)) { |
| 100 | err = security_secid_to_secctx(scm->secid, &secdata, &seclen); |
| 101 | |
| 102 | if (!err) { |
| 103 | put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, seclen, secdata); |
| 104 | security_release_secctx(secdata, seclen); |
| 105 | } |
| 106 | } |
Catherine Zhang | 877ce7c | 2006-06-29 12:27:47 -0700 | [diff] [blame] | 107 | } |
| 108 | #else |
| 109 | static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm) |
| 110 | { } |
| 111 | #endif /* CONFIG_SECURITY_NETWORK */ |
| 112 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 113 | static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg, |
| 114 | struct scm_cookie *scm, int flags) |
| 115 | { |
Eric Dumazet | fd2c3ef | 2009-11-03 03:26:03 +0000 | [diff] [blame] | 116 | if (!msg->msg_control) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 117 | if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp) |
| 118 | msg->msg_flags |= MSG_CTRUNC; |
David S. Miller | f78a5fd | 2011-09-16 19:34:00 -0400 | [diff] [blame] | 119 | scm_destroy(scm); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 120 | return; |
| 121 | } |
| 122 | |
Eric W. Biederman | dbe9a41 | 2012-09-06 18:20:01 +0000 | [diff] [blame] | 123 | if (test_bit(SOCK_PASSCRED, &sock->flags)) { |
| 124 | struct user_namespace *current_ns = current_user_ns(); |
| 125 | struct ucred ucreds = { |
| 126 | .pid = scm->creds.pid, |
| 127 | .uid = from_kuid_munged(current_ns, scm->creds.uid), |
| 128 | .gid = from_kgid_munged(current_ns, scm->creds.gid), |
| 129 | }; |
| 130 | put_cmsg(msg, SOL_SOCKET, SCM_CREDENTIALS, sizeof(ucreds), &ucreds); |
| 131 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 132 | |
David S. Miller | f78a5fd | 2011-09-16 19:34:00 -0400 | [diff] [blame] | 133 | scm_destroy_cred(scm); |
| 134 | |
Catherine Zhang | 877ce7c | 2006-06-29 12:27:47 -0700 | [diff] [blame] | 135 | scm_passec(sock, msg, scm); |
| 136 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 137 | if (!scm->fp) |
| 138 | return; |
| 139 | |
| 140 | scm_detach_fds(msg, scm); |
| 141 | } |
| 142 | |
| 143 | |
| 144 | #endif /* __LINUX_NET_SCM_H */ |
| 145 | |