Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | #ifndef __LINUX_NET_SCM_H |
| 2 | #define __LINUX_NET_SCM_H |
| 3 | |
| 4 | #include <linux/limits.h> |
| 5 | #include <linux/net.h> |
Catherine Zhang | dc49c1f | 2006-08-02 14:12:06 -0700 | [diff] [blame] | 6 | #include <linux/security.h> |
Pavel Emelyanov | b488893 | 2007-10-18 23:40:14 -0700 | [diff] [blame] | 7 | #include <linux/pid.h> |
| 8 | #include <linux/nsproxy.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 9 | |
| 10 | /* Well, we should have at least one descriptor open |
| 11 | * to accept passed FDs 8) |
| 12 | */ |
Eric Dumazet | bba14de | 2010-11-23 14:09:15 +0000 | [diff] [blame] | 13 | #define SCM_MAX_FD 253 |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 14 | |
Eric W. Biederman | dbe9a41 | 2012-09-06 18:20:01 +0000 | [diff] [blame] | 15 | struct scm_creds { |
| 16 | u32 pid; |
| 17 | kuid_t uid; |
| 18 | kgid_t gid; |
| 19 | }; |
| 20 | |
Eric Dumazet | fd2c3ef | 2009-11-03 03:26:03 +0000 | [diff] [blame] | 21 | struct scm_fp_list { |
Eric Dumazet | bba14de | 2010-11-23 14:09:15 +0000 | [diff] [blame] | 22 | short count; |
| 23 | short max; |
David Miller | f8d570a | 2008-11-06 00:37:40 -0800 | [diff] [blame] | 24 | struct file *fp[SCM_MAX_FD]; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 25 | }; |
| 26 | |
Eric Dumazet | fd2c3ef | 2009-11-03 03:26:03 +0000 | [diff] [blame] | 27 | struct scm_cookie { |
Eric W. Biederman | 257b535 | 2010-06-13 03:32:34 +0000 | [diff] [blame] | 28 | struct pid *pid; /* Skb credentials */ |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 29 | struct scm_fp_list *fp; /* Passed files */ |
Eric W. Biederman | dbe9a41 | 2012-09-06 18:20:01 +0000 | [diff] [blame] | 30 | struct scm_creds creds; /* Skb credentials */ |
Catherine Zhang | 877ce7c | 2006-06-29 12:27:47 -0700 | [diff] [blame] | 31 | #ifdef CONFIG_SECURITY_NETWORK |
Catherine Zhang | dc49c1f | 2006-08-02 14:12:06 -0700 | [diff] [blame] | 32 | u32 secid; /* Passed security ID */ |
Catherine Zhang | 877ce7c | 2006-06-29 12:27:47 -0700 | [diff] [blame] | 33 | #endif |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 34 | }; |
| 35 | |
| 36 | extern void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm); |
| 37 | extern void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm); |
| 38 | extern int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm); |
| 39 | extern void __scm_destroy(struct scm_cookie *scm); |
| 40 | extern struct scm_fp_list * scm_fp_dup(struct scm_fp_list *fpl); |
| 41 | |
Catherine Zhang | dc49c1f | 2006-08-02 14:12:06 -0700 | [diff] [blame] | 42 | #ifdef CONFIG_SECURITY_NETWORK |
| 43 | static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm) |
| 44 | { |
| 45 | security_socket_getpeersec_dgram(sock, NULL, &scm->secid); |
| 46 | } |
| 47 | #else |
| 48 | static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm) |
| 49 | { } |
| 50 | #endif /* CONFIG_SECURITY_NETWORK */ |
| 51 | |
Eric W. Biederman | 257b535 | 2010-06-13 03:32:34 +0000 | [diff] [blame] | 52 | static __inline__ void scm_set_cred(struct scm_cookie *scm, |
Eric W. Biederman | 6b0ee8c0 | 2013-04-03 17:28:16 +0000 | [diff] [blame] | 53 | struct pid *pid, kuid_t uid, kgid_t gid) |
Eric W. Biederman | 257b535 | 2010-06-13 03:32:34 +0000 | [diff] [blame] | 54 | { |
| 55 | scm->pid = get_pid(pid); |
Eric W. Biederman | dbe9a41 | 2012-09-06 18:20:01 +0000 | [diff] [blame] | 56 | scm->creds.pid = pid_vnr(pid); |
Eric W. Biederman | 6b0ee8c0 | 2013-04-03 17:28:16 +0000 | [diff] [blame] | 57 | scm->creds.uid = uid; |
| 58 | scm->creds.gid = gid; |
Eric W. Biederman | 257b535 | 2010-06-13 03:32:34 +0000 | [diff] [blame] | 59 | } |
| 60 | |
| 61 | static __inline__ void scm_destroy_cred(struct scm_cookie *scm) |
| 62 | { |
| 63 | put_pid(scm->pid); |
| 64 | scm->pid = NULL; |
Eric W. Biederman | 257b535 | 2010-06-13 03:32:34 +0000 | [diff] [blame] | 65 | } |
| 66 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 67 | static __inline__ void scm_destroy(struct scm_cookie *scm) |
| 68 | { |
Eric W. Biederman | 257b535 | 2010-06-13 03:32:34 +0000 | [diff] [blame] | 69 | scm_destroy_cred(scm); |
David S. Miller | 2a6c8c7 | 2012-09-24 15:52:33 -0400 | [diff] [blame] | 70 | if (scm->fp) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 71 | __scm_destroy(scm); |
| 72 | } |
| 73 | |
| 74 | static __inline__ int scm_send(struct socket *sock, struct msghdr *msg, |
Eric Dumazet | e0e3cea | 2012-08-21 06:21:17 +0000 | [diff] [blame] | 75 | struct scm_cookie *scm, bool forcecreds) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 76 | { |
Eric Dumazet | 16e5726 | 2011-09-19 05:52:27 +0000 | [diff] [blame] | 77 | memset(scm, 0, sizeof(*scm)); |
Eric W. Biederman | 6b0ee8c0 | 2013-04-03 17:28:16 +0000 | [diff] [blame] | 78 | scm->creds.uid = INVALID_UID; |
| 79 | scm->creds.gid = INVALID_GID; |
Eric Dumazet | e0e3cea | 2012-08-21 06:21:17 +0000 | [diff] [blame] | 80 | if (forcecreds) |
David S. Miller | 6e0895c | 2013-04-22 20:32:51 -0400 | [diff] [blame] | 81 | scm_set_cred(scm, task_tgid(current), current_uid(), current_gid()); |
Catherine Zhang | dc49c1f | 2006-08-02 14:12:06 -0700 | [diff] [blame] | 82 | unix_get_peersec_dgram(sock, scm); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 83 | if (msg->msg_controllen <= 0) |
| 84 | return 0; |
| 85 | return __scm_send(sock, msg, scm); |
| 86 | } |
| 87 | |
Catherine Zhang | 877ce7c | 2006-06-29 12:27:47 -0700 | [diff] [blame] | 88 | #ifdef CONFIG_SECURITY_NETWORK |
| 89 | static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm) |
| 90 | { |
Catherine Zhang | dc49c1f | 2006-08-02 14:12:06 -0700 | [diff] [blame] | 91 | char *secdata; |
| 92 | u32 seclen; |
| 93 | int err; |
| 94 | |
| 95 | if (test_bit(SOCK_PASSSEC, &sock->flags)) { |
| 96 | err = security_secid_to_secctx(scm->secid, &secdata, &seclen); |
| 97 | |
| 98 | if (!err) { |
| 99 | put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, seclen, secdata); |
| 100 | security_release_secctx(secdata, seclen); |
| 101 | } |
| 102 | } |
Catherine Zhang | 877ce7c | 2006-06-29 12:27:47 -0700 | [diff] [blame] | 103 | } |
| 104 | #else |
| 105 | static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm) |
| 106 | { } |
| 107 | #endif /* CONFIG_SECURITY_NETWORK */ |
| 108 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 109 | static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg, |
| 110 | struct scm_cookie *scm, int flags) |
| 111 | { |
Eric Dumazet | fd2c3ef | 2009-11-03 03:26:03 +0000 | [diff] [blame] | 112 | if (!msg->msg_control) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 113 | if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp) |
| 114 | msg->msg_flags |= MSG_CTRUNC; |
David S. Miller | f78a5fd | 2011-09-16 19:34:00 -0400 | [diff] [blame] | 115 | scm_destroy(scm); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 116 | return; |
| 117 | } |
| 118 | |
Eric W. Biederman | dbe9a41 | 2012-09-06 18:20:01 +0000 | [diff] [blame] | 119 | if (test_bit(SOCK_PASSCRED, &sock->flags)) { |
| 120 | struct user_namespace *current_ns = current_user_ns(); |
| 121 | struct ucred ucreds = { |
| 122 | .pid = scm->creds.pid, |
| 123 | .uid = from_kuid_munged(current_ns, scm->creds.uid), |
| 124 | .gid = from_kgid_munged(current_ns, scm->creds.gid), |
| 125 | }; |
| 126 | put_cmsg(msg, SOL_SOCKET, SCM_CREDENTIALS, sizeof(ucreds), &ucreds); |
| 127 | } |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 128 | |
David S. Miller | f78a5fd | 2011-09-16 19:34:00 -0400 | [diff] [blame] | 129 | scm_destroy_cred(scm); |
| 130 | |
Catherine Zhang | 877ce7c | 2006-06-29 12:27:47 -0700 | [diff] [blame] | 131 | scm_passec(sock, msg, scm); |
| 132 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 133 | if (!scm->fp) |
| 134 | return; |
| 135 | |
| 136 | scm_detach_fds(msg, scm); |
| 137 | } |
| 138 | |
| 139 | |
| 140 | #endif /* __LINUX_NET_SCM_H */ |
| 141 | |