CRED: Use RCU to access another task's creds and to release a task's own creds
Use RCU to access another task's creds and to release a task's own creds.
This means that it will be possible for the credentials of a task to be
replaced without another task (a) requiring a full lock to read them, and (b)
seeing deallocated memory.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>
diff --git a/security/commoncap.c b/security/commoncap.c
index 61307f5..0384bf9 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -51,10 +51,13 @@
*/
int cap_capable(struct task_struct *tsk, int cap, int audit)
{
+ __u32 cap_raised;
+
/* Derived from include/linux/sched.h:capable. */
- if (cap_raised(tsk->cred->cap_effective, cap))
- return 0;
- return -EPERM;
+ rcu_read_lock();
+ cap_raised = cap_raised(__task_cred(tsk)->cap_effective, cap);
+ rcu_read_unlock();
+ return cap_raised ? 0 : -EPERM;
}
int cap_settime(struct timespec *ts, struct timezone *tz)
@@ -66,34 +69,42 @@
int cap_ptrace_may_access(struct task_struct *child, unsigned int mode)
{
- /* Derived from arch/i386/kernel/ptrace.c:sys_ptrace. */
- if (cap_issubset(child->cred->cap_permitted,
- current->cred->cap_permitted))
- return 0;
- if (capable(CAP_SYS_PTRACE))
- return 0;
- return -EPERM;
+ int ret = 0;
+
+ rcu_read_lock();
+ if (!cap_issubset(child->cred->cap_permitted,
+ current->cred->cap_permitted) &&
+ !capable(CAP_SYS_PTRACE))
+ ret = -EPERM;
+ rcu_read_unlock();
+ return ret;
}
int cap_ptrace_traceme(struct task_struct *parent)
{
- if (cap_issubset(current->cred->cap_permitted,
- parent->cred->cap_permitted))
- return 0;
- if (has_capability(parent, CAP_SYS_PTRACE))
- return 0;
- return -EPERM;
+ int ret = 0;
+
+ rcu_read_lock();
+ if (!cap_issubset(current->cred->cap_permitted,
+ parent->cred->cap_permitted) &&
+ !has_capability(parent, CAP_SYS_PTRACE))
+ ret = -EPERM;
+ rcu_read_unlock();
+ return ret;
}
int cap_capget (struct task_struct *target, kernel_cap_t *effective,
kernel_cap_t *inheritable, kernel_cap_t *permitted)
{
- struct cred *cred = target->cred;
+ const struct cred *cred;
/* Derived from kernel/capability.c:sys_capget. */
+ rcu_read_lock();
+ cred = __task_cred(target);
*effective = cred->cap_effective;
*inheritable = cred->cap_inheritable;
*permitted = cred->cap_permitted;
+ rcu_read_unlock();
return 0;
}
@@ -433,7 +444,7 @@
int cap_bprm_secureexec (struct linux_binprm *bprm)
{
- const struct cred *cred = current->cred;
+ const struct cred *cred = current_cred();
if (cred->uid != 0) {
if (bprm->cap_effective)
@@ -511,11 +522,11 @@
if ((old_ruid == 0 || old_euid == 0 || old_suid == 0) &&
(cred->uid != 0 && cred->euid != 0 && cred->suid != 0) &&
!issecure(SECURE_KEEP_CAPS)) {
- cap_clear (cred->cap_permitted);
- cap_clear (cred->cap_effective);
+ cap_clear(cred->cap_permitted);
+ cap_clear(cred->cap_effective);
}
if (old_euid == 0 && cred->euid != 0) {
- cap_clear (cred->cap_effective);
+ cap_clear(cred->cap_effective);
}
if (old_euid != 0 && cred->euid == 0) {
cred->cap_effective = cred->cap_permitted;
@@ -582,9 +593,14 @@
*/
static int cap_safe_nice(struct task_struct *p)
{
- if (!cap_issubset(p->cred->cap_permitted,
- current->cred->cap_permitted) &&
- !capable(CAP_SYS_NICE))
+ int is_subset;
+
+ rcu_read_lock();
+ is_subset = cap_issubset(__task_cred(p)->cap_permitted,
+ current_cred()->cap_permitted);
+ rcu_read_unlock();
+
+ if (!is_subset && !capable(CAP_SYS_NICE))
return -EPERM;
return 0;
}
diff --git a/security/keys/permission.c b/security/keys/permission.c
index baf3d5f..13c3616 100644
--- a/security/keys/permission.c
+++ b/security/keys/permission.c
@@ -22,13 +22,16 @@
struct task_struct *context,
key_perm_t perm)
{
- struct cred *cred = context->cred;
+ const struct cred *cred;
struct key *key;
key_perm_t kperm;
int ret;
key = key_ref_to_ptr(key_ref);
+ rcu_read_lock();
+ cred = __task_cred(context);
+
/* use the second 8-bits of permissions for keys the caller owns */
if (key->uid == cred->fsuid) {
kperm = key->perm >> 16;
@@ -43,10 +46,7 @@
goto use_these_perms;
}
- spin_lock(&cred->lock);
ret = groups_search(cred->group_info, key->gid);
- spin_unlock(&cred->lock);
-
if (ret) {
kperm = key->perm >> 8;
goto use_these_perms;
@@ -57,6 +57,8 @@
kperm = key->perm;
use_these_perms:
+ rcu_read_lock();
+
/* use the top 8-bits of permissions for keys the caller possesses
* - possessor permissions are additive with other permissions
*/
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index ce8ac60..212601e 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -412,10 +412,13 @@
struct task_struct *context)
{
struct request_key_auth *rka;
+ struct cred *cred;
key_ref_t key_ref, ret, err;
might_sleep();
+ cred = get_task_cred(context);
+
/* we want to return -EAGAIN or -ENOKEY if any of the keyrings were
* searchable, but we failed to find a key or we found a negative key;
* otherwise we want to return a sample error (probably -EACCES) if
@@ -428,9 +431,9 @@
err = ERR_PTR(-EAGAIN);
/* search the thread keyring first */
- if (context->cred->thread_keyring) {
+ if (cred->thread_keyring) {
key_ref = keyring_search_aux(
- make_key_ref(context->cred->thread_keyring, 1),
+ make_key_ref(cred->thread_keyring, 1),
context, type, description, match);
if (!IS_ERR(key_ref))
goto found;
@@ -495,9 +498,9 @@
}
}
/* or search the user-session keyring */
- else if (context->cred->user->session_keyring) {
+ else if (cred->user->session_keyring) {
key_ref = keyring_search_aux(
- make_key_ref(context->cred->user->session_keyring, 1),
+ make_key_ref(cred->user->session_keyring, 1),
context, type, description, match);
if (!IS_ERR(key_ref))
goto found;
@@ -519,20 +522,20 @@
* search the keyrings of the process mentioned there
* - we don't permit access to request_key auth keys via this method
*/
- if (context->cred->request_key_auth &&
+ if (cred->request_key_auth &&
context == current &&
type != &key_type_request_key_auth
) {
/* defend against the auth key being revoked */
- down_read(&context->cred->request_key_auth->sem);
+ down_read(&cred->request_key_auth->sem);
- if (key_validate(context->cred->request_key_auth) == 0) {
- rka = context->cred->request_key_auth->payload.data;
+ if (key_validate(cred->request_key_auth) == 0) {
+ rka = cred->request_key_auth->payload.data;
key_ref = search_process_keyrings(type, description,
match, rka->context);
- up_read(&context->cred->request_key_auth->sem);
+ up_read(&cred->request_key_auth->sem);
if (!IS_ERR(key_ref))
goto found;
@@ -549,7 +552,7 @@
break;
}
} else {
- up_read(&context->cred->request_key_auth->sem);
+ up_read(&cred->request_key_auth->sem);
}
}
@@ -557,6 +560,7 @@
key_ref = ret ? ret : err;
found:
+ put_cred(cred);
return key_ref;
} /* end search_process_keyrings() */
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 10715d1..c863036 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -95,13 +95,18 @@
static int task_has_security(struct task_struct *tsk,
u32 perms)
{
- struct task_security_struct *tsec;
+ const struct task_security_struct *tsec;
+ u32 sid = 0;
- tsec = tsk->cred->security;
+ rcu_read_lock();
+ tsec = __task_cred(tsk)->security;
+ if (tsec)
+ sid = tsec->sid;
+ rcu_read_unlock();
if (!tsec)
return -EACCES;
- return avc_has_perm(tsec->sid, SECINITSID_SECURITY,
+ return avc_has_perm(sid, SECINITSID_SECURITY,
SECCLASS_SECURITY, perms, NULL);
}
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index e8a4fcb..11167fd 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -30,6 +30,8 @@
#include "smack.h"
+#define task_security(task) (task_cred_xxx((task), security))
+
/*
* I hope these are the hokeyist lines of code in the module. Casey.
*/
@@ -1012,7 +1014,7 @@
*/
static int smack_task_setpgid(struct task_struct *p, pid_t pgid)
{
- return smk_curacc(p->cred->security, MAY_WRITE);
+ return smk_curacc(task_security(p), MAY_WRITE);
}
/**
@@ -1023,7 +1025,7 @@
*/
static int smack_task_getpgid(struct task_struct *p)
{
- return smk_curacc(p->cred->security, MAY_READ);
+ return smk_curacc(task_security(p), MAY_READ);
}
/**
@@ -1034,7 +1036,7 @@
*/
static int smack_task_getsid(struct task_struct *p)
{
- return smk_curacc(p->cred->security, MAY_READ);
+ return smk_curacc(task_security(p), MAY_READ);
}
/**
@@ -1046,7 +1048,7 @@
*/
static void smack_task_getsecid(struct task_struct *p, u32 *secid)
{
- *secid = smack_to_secid(p->cred->security);
+ *secid = smack_to_secid(task_security(p));
}
/**
@@ -1062,7 +1064,7 @@
rc = cap_task_setnice(p, nice);
if (rc == 0)
- rc = smk_curacc(p->cred->security, MAY_WRITE);
+ rc = smk_curacc(task_security(p), MAY_WRITE);
return rc;
}
@@ -1079,7 +1081,7 @@
rc = cap_task_setioprio(p, ioprio);
if (rc == 0)
- rc = smk_curacc(p->cred->security, MAY_WRITE);
+ rc = smk_curacc(task_security(p), MAY_WRITE);
return rc;
}
@@ -1091,7 +1093,7 @@
*/
static int smack_task_getioprio(struct task_struct *p)
{
- return smk_curacc(p->cred->security, MAY_READ);
+ return smk_curacc(task_security(p), MAY_READ);
}
/**
@@ -1109,7 +1111,7 @@
rc = cap_task_setscheduler(p, policy, lp);
if (rc == 0)
- rc = smk_curacc(p->cred->security, MAY_WRITE);
+ rc = smk_curacc(task_security(p), MAY_WRITE);
return rc;
}
@@ -1121,7 +1123,7 @@
*/
static int smack_task_getscheduler(struct task_struct *p)
{
- return smk_curacc(p->cred->security, MAY_READ);
+ return smk_curacc(task_security(p), MAY_READ);
}
/**
@@ -1132,7 +1134,7 @@
*/
static int smack_task_movememory(struct task_struct *p)
{
- return smk_curacc(p->cred->security, MAY_WRITE);
+ return smk_curacc(task_security(p), MAY_WRITE);
}
/**
@@ -1155,13 +1157,13 @@
* can write the receiver.
*/
if (secid == 0)
- return smk_curacc(p->cred->security, MAY_WRITE);
+ return smk_curacc(task_security(p), MAY_WRITE);
/*
* If the secid isn't 0 we're dealing with some USB IO
* specific behavior. This is not clean. For one thing
* we can't take privilege into account.
*/
- return smk_access(smack_from_secid(secid), p->cred->security, MAY_WRITE);
+ return smk_access(smack_from_secid(secid), task_security(p), MAY_WRITE);
}
/**
@@ -1174,7 +1176,7 @@
{
int rc;
- rc = smk_access(current->cred->security, p->cred->security, MAY_WRITE);
+ rc = smk_access(current_security(), task_security(p), MAY_WRITE);
if (rc == 0)
return 0;
@@ -1205,7 +1207,7 @@
static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
{
struct inode_smack *isp = inode->i_security;
- isp->smk_inode = p->cred->security;
+ isp->smk_inode = task_security(p);
}
/*
@@ -2010,7 +2012,7 @@
if (strcmp(name, "current") != 0)
return -EINVAL;
- cp = kstrdup(p->cred->security, GFP_KERNEL);
+ cp = kstrdup(task_security(p), GFP_KERNEL);
if (cp == NULL)
return -ENOMEM;