Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | #ifndef __LINUX_NET_SCM_H |
| 2 | #define __LINUX_NET_SCM_H |
| 3 | |
| 4 | #include <linux/limits.h> |
| 5 | #include <linux/net.h> |
Ingo Molnar | 5b825c3 | 2017-02-02 17:54:15 +0100 | [diff] [blame] | 6 | #include <linux/cred.h> |
Catherine Zhang | dc49c1f | 2006-08-02 14:12:06 -0700 | [diff] [blame] | 7 | #include <linux/security.h> |
Pavel Emelyanov | b488893 | 2007-10-18 23:40:14 -0700 | [diff] [blame] | 8 | #include <linux/pid.h> |
| 9 | #include <linux/nsproxy.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 10 | |
| 11 | /* Well, we should have at least one descriptor open |
| 12 | * to accept passed FDs 8) |
| 13 | */ |
Eric Dumazet | bba14de | 2010-11-23 14:09:15 +0000 | [diff] [blame] | 14 | #define SCM_MAX_FD 253 |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 15 | |
Eric W. Biederman | dbe9a41 | 2012-09-06 18:20:01 +0000 | [diff] [blame] | 16 | struct scm_creds { |
| 17 | u32 pid; |
| 18 | kuid_t uid; |
| 19 | kgid_t gid; |
| 20 | }; |
| 21 | |
Eric Dumazet | fd2c3ef | 2009-11-03 03:26:03 +0000 | [diff] [blame] | 22 | struct scm_fp_list { |
Eric Dumazet | bba14de | 2010-11-23 14:09:15 +0000 | [diff] [blame] | 23 | short count; |
| 24 | short max; |
Hannes Frederic Sowa | 415e3d3 | 2016-02-03 02:11:03 +0100 | [diff] [blame] | 25 | struct user_struct *user; |
David Miller | f8d570a | 2008-11-06 00:37:40 -0800 | [diff] [blame] | 26 | struct file *fp[SCM_MAX_FD]; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 27 | }; |
| 28 | |
Eric Dumazet | fd2c3ef | 2009-11-03 03:26:03 +0000 | [diff] [blame] | 29 | struct scm_cookie { |
Eric W. Biederman | 257b535 | 2010-06-13 03:32:34 +0000 | [diff] [blame] | 30 | struct pid *pid; /* Skb credentials */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 31 | struct scm_fp_list *fp; /* Passed files */ |
Eric W. Biederman | dbe9a41 | 2012-09-06 18:20:01 +0000 | [diff] [blame] | 32 | struct scm_creds creds; /* Skb credentials */ |
Catherine Zhang | 877ce7c | 2006-06-29 12:27:47 -0700 | [diff] [blame] | 33 | #ifdef CONFIG_SECURITY_NETWORK |
Catherine Zhang | dc49c1f | 2006-08-02 14:12:06 -0700 | [diff] [blame] | 34 | u32 secid; /* Passed security ID */ |
Catherine Zhang | 877ce7c | 2006-06-29 12:27:47 -0700 | [diff] [blame] | 35 | #endif |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 36 | }; |
| 37 | |
Joe Perches | 8153ff5 | 2013-09-22 10:32:24 -0700 | [diff] [blame] | 38 | void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm); |
| 39 | void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm); |
| 40 | int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm); |
| 41 | void __scm_destroy(struct scm_cookie *scm); |
| 42 | struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 43 | |
Catherine Zhang | dc49c1f | 2006-08-02 14:12:06 -0700 | [diff] [blame] | 44 | #ifdef CONFIG_SECURITY_NETWORK |
| 45 | static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm) |
| 46 | { |
| 47 | security_socket_getpeersec_dgram(sock, NULL, &scm->secid); |
| 48 | } |
| 49 | #else |
| 50 | static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm) |
| 51 | { } |
| 52 | #endif /* CONFIG_SECURITY_NETWORK */ |
| 53 | |
Eric W. Biederman | 257b535 | 2010-06-13 03:32:34 +0000 | [diff] [blame] | 54 | static __inline__ void scm_set_cred(struct scm_cookie *scm, |
Eric W. Biederman | 6b0ee8c0 | 2013-04-03 17:28:16 +0000 | [diff] [blame] | 55 | struct pid *pid, kuid_t uid, kgid_t gid) |
Eric W. Biederman | 257b535 | 2010-06-13 03:32:34 +0000 | [diff] [blame] | 56 | { |
| 57 | scm->pid = get_pid(pid); |
Eric W. Biederman | dbe9a41 | 2012-09-06 18:20:01 +0000 | [diff] [blame] | 58 | scm->creds.pid = pid_vnr(pid); |
Eric W. Biederman | 6b0ee8c0 | 2013-04-03 17:28:16 +0000 | [diff] [blame] | 59 | scm->creds.uid = uid; |
| 60 | scm->creds.gid = gid; |
Eric W. Biederman | 257b535 | 2010-06-13 03:32:34 +0000 | [diff] [blame] | 61 | } |
| 62 | |
| 63 | static __inline__ void scm_destroy_cred(struct scm_cookie *scm) |
| 64 | { |
| 65 | put_pid(scm->pid); |
| 66 | scm->pid = NULL; |
Eric W. Biederman | 257b535 | 2010-06-13 03:32:34 +0000 | [diff] [blame] | 67 | } |
| 68 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 69 | static __inline__ void scm_destroy(struct scm_cookie *scm) |
| 70 | { |
Eric W. Biederman | 257b535 | 2010-06-13 03:32:34 +0000 | [diff] [blame] | 71 | scm_destroy_cred(scm); |
David S. Miller | 2a6c8c7 | 2012-09-24 15:52:33 -0400 | [diff] [blame] | 72 | if (scm->fp) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 73 | __scm_destroy(scm); |
| 74 | } |
| 75 | |
| 76 | static __inline__ int scm_send(struct socket *sock, struct msghdr *msg, |
Eric Dumazet | e0e3cea | 2012-08-21 06:21:17 +0000 | [diff] [blame] | 77 | struct scm_cookie *scm, bool forcecreds) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 78 | { |
Eric Dumazet | 16e5726 | 2011-09-19 05:52:27 +0000 | [diff] [blame] | 79 | memset(scm, 0, sizeof(*scm)); |
Eric W. Biederman | 6b0ee8c0 | 2013-04-03 17:28:16 +0000 | [diff] [blame] | 80 | scm->creds.uid = INVALID_UID; |
| 81 | scm->creds.gid = INVALID_GID; |
Eric Dumazet | e0e3cea | 2012-08-21 06:21:17 +0000 | [diff] [blame] | 82 | if (forcecreds) |
David S. Miller | 6e0895c | 2013-04-22 20:32:51 -0400 | [diff] [blame] | 83 | scm_set_cred(scm, task_tgid(current), current_uid(), current_gid()); |
Catherine Zhang | dc49c1f | 2006-08-02 14:12:06 -0700 | [diff] [blame] | 84 | unix_get_peersec_dgram(sock, scm); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 85 | if (msg->msg_controllen <= 0) |
| 86 | return 0; |
| 87 | return __scm_send(sock, msg, scm); |
| 88 | } |
| 89 | |
Catherine Zhang | 877ce7c | 2006-06-29 12:27:47 -0700 | [diff] [blame] | 90 | #ifdef CONFIG_SECURITY_NETWORK |
| 91 | static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm) |
| 92 | { |
Catherine Zhang | dc49c1f | 2006-08-02 14:12:06 -0700 | [diff] [blame] | 93 | char *secdata; |
| 94 | u32 seclen; |
| 95 | int err; |
| 96 | |
| 97 | if (test_bit(SOCK_PASSSEC, &sock->flags)) { |
| 98 | err = security_secid_to_secctx(scm->secid, &secdata, &seclen); |
| 99 | |
| 100 | if (!err) { |
| 101 | put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, seclen, secdata); |
| 102 | security_release_secctx(secdata, seclen); |
| 103 | } |
| 104 | } |
Catherine Zhang | 877ce7c | 2006-06-29 12:27:47 -0700 | [diff] [blame] | 105 | } |
| 106 | #else |
| 107 | static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm) |
| 108 | { } |
| 109 | #endif /* CONFIG_SECURITY_NETWORK */ |
| 110 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 111 | static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg, |
| 112 | struct scm_cookie *scm, int flags) |
| 113 | { |
Eric Dumazet | fd2c3ef | 2009-11-03 03:26:03 +0000 | [diff] [blame] | 114 | if (!msg->msg_control) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 115 | if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp) |
| 116 | msg->msg_flags |= MSG_CTRUNC; |
David S. Miller | f78a5fd | 2011-09-16 19:34:00 -0400 | [diff] [blame] | 117 | scm_destroy(scm); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 118 | return; |
| 119 | } |
| 120 | |
Eric W. Biederman | dbe9a41 | 2012-09-06 18:20:01 +0000 | [diff] [blame] | 121 | if (test_bit(SOCK_PASSCRED, &sock->flags)) { |
| 122 | struct user_namespace *current_ns = current_user_ns(); |
| 123 | struct ucred ucreds = { |
| 124 | .pid = scm->creds.pid, |
| 125 | .uid = from_kuid_munged(current_ns, scm->creds.uid), |
| 126 | .gid = from_kgid_munged(current_ns, scm->creds.gid), |
| 127 | }; |
| 128 | put_cmsg(msg, SOL_SOCKET, SCM_CREDENTIALS, sizeof(ucreds), &ucreds); |
| 129 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 130 | |
David S. Miller | f78a5fd | 2011-09-16 19:34:00 -0400 | [diff] [blame] | 131 | scm_destroy_cred(scm); |
| 132 | |
Catherine Zhang | 877ce7c | 2006-06-29 12:27:47 -0700 | [diff] [blame] | 133 | scm_passec(sock, msg, scm); |
| 134 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 135 | if (!scm->fp) |
| 136 | return; |
| 137 | |
| 138 | scm_detach_fds(msg, scm); |
| 139 | } |
| 140 | |
| 141 | |
| 142 | #endif /* __LINUX_NET_SCM_H */ |
| 143 | |