blob: 5a4c6a9eb12258449abad265eda33692ab00f908 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001#ifndef __LINUX_NET_SCM_H
2#define __LINUX_NET_SCM_H
3
4#include <linux/limits.h>
5#include <linux/net.h>
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006#include <linux/security.h>
Pavel Emelyanovb4888932007-10-18 23:40:14 -07007#include <linux/pid.h>
8#include <linux/nsproxy.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -07009
10/* Well, we should have at least one descriptor open
11 * to accept passed FDs 8)
12 */
Eric Dumazetbba14de2010-11-23 14:09:15 +000013#define SCM_MAX_FD 253
Linus Torvalds1da177e2005-04-16 15:20:36 -070014
Eric W. Biedermandbe9a412012-09-06 18:20:01 +000015struct scm_creds {
16 u32 pid;
17 kuid_t uid;
18 kgid_t gid;
19};
20
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +000021struct scm_fp_list {
Eric Dumazetbba14de2010-11-23 14:09:15 +000022 short count;
23 short max;
David Millerf8d570a2008-11-06 00:37:40 -080024 struct file *fp[SCM_MAX_FD];
Linus Torvalds1da177e2005-04-16 15:20:36 -070025};
26
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +000027struct scm_cookie {
Eric W. Biederman257b5352010-06-13 03:32:34 +000028 struct pid *pid; /* Skb credentials */
Linus Torvalds1da177e2005-04-16 15:20:36 -070029 struct scm_fp_list *fp; /* Passed files */
Eric W. Biedermandbe9a412012-09-06 18:20:01 +000030 struct scm_creds creds; /* Skb credentials */
Catherine Zhang877ce7c2006-06-29 12:27:47 -070031#ifdef CONFIG_SECURITY_NETWORK
Catherine Zhangdc49c1f2006-08-02 14:12:06 -070032 u32 secid; /* Passed security ID */
Catherine Zhang877ce7c2006-06-29 12:27:47 -070033#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -070034};
35
36extern void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm);
37extern void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm);
38extern int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm);
39extern void __scm_destroy(struct scm_cookie *scm);
40extern struct scm_fp_list * scm_fp_dup(struct scm_fp_list *fpl);
41
Catherine Zhangdc49c1f2006-08-02 14:12:06 -070042#ifdef CONFIG_SECURITY_NETWORK
43static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm)
44{
45 security_socket_getpeersec_dgram(sock, NULL, &scm->secid);
46}
47#else
48static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm)
49{ }
50#endif /* CONFIG_SECURITY_NETWORK */
51
Eric W. Biederman257b5352010-06-13 03:32:34 +000052static __inline__ void scm_set_cred(struct scm_cookie *scm,
Eric W. Biederman6b0ee8c02013-04-03 17:28:16 +000053 struct pid *pid, kuid_t uid, kgid_t gid)
Eric W. Biederman257b5352010-06-13 03:32:34 +000054{
55 scm->pid = get_pid(pid);
Eric W. Biedermandbe9a412012-09-06 18:20:01 +000056 scm->creds.pid = pid_vnr(pid);
Eric W. Biederman6b0ee8c02013-04-03 17:28:16 +000057 scm->creds.uid = uid;
58 scm->creds.gid = gid;
Eric W. Biederman257b5352010-06-13 03:32:34 +000059}
60
61static __inline__ void scm_destroy_cred(struct scm_cookie *scm)
62{
63 put_pid(scm->pid);
64 scm->pid = NULL;
Eric W. Biederman257b5352010-06-13 03:32:34 +000065}
66
Linus Torvalds1da177e2005-04-16 15:20:36 -070067static __inline__ void scm_destroy(struct scm_cookie *scm)
68{
Eric W. Biederman257b5352010-06-13 03:32:34 +000069 scm_destroy_cred(scm);
David S. Miller2a6c8c72012-09-24 15:52:33 -040070 if (scm->fp)
Linus Torvalds1da177e2005-04-16 15:20:36 -070071 __scm_destroy(scm);
72}
73
74static __inline__ int scm_send(struct socket *sock, struct msghdr *msg,
Eric Dumazete0e3cea2012-08-21 06:21:17 +000075 struct scm_cookie *scm, bool forcecreds)
Linus Torvalds1da177e2005-04-16 15:20:36 -070076{
Eric Dumazet16e57262011-09-19 05:52:27 +000077 memset(scm, 0, sizeof(*scm));
Eric W. Biederman6b0ee8c02013-04-03 17:28:16 +000078 scm->creds.uid = INVALID_UID;
79 scm->creds.gid = INVALID_GID;
Eric Dumazete0e3cea2012-08-21 06:21:17 +000080 if (forcecreds)
Eric W. Biederman6b0ee8c02013-04-03 17:28:16 +000081 scm_set_cred(scm, task_tgid(current), current_euid(), current_egid());
Catherine Zhangdc49c1f2006-08-02 14:12:06 -070082 unix_get_peersec_dgram(sock, scm);
Linus Torvalds1da177e2005-04-16 15:20:36 -070083 if (msg->msg_controllen <= 0)
84 return 0;
85 return __scm_send(sock, msg, scm);
86}
87
Catherine Zhang877ce7c2006-06-29 12:27:47 -070088#ifdef CONFIG_SECURITY_NETWORK
89static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
90{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -070091 char *secdata;
92 u32 seclen;
93 int err;
94
95 if (test_bit(SOCK_PASSSEC, &sock->flags)) {
96 err = security_secid_to_secctx(scm->secid, &secdata, &seclen);
97
98 if (!err) {
99 put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, seclen, secdata);
100 security_release_secctx(secdata, seclen);
101 }
102 }
Catherine Zhang877ce7c2006-06-29 12:27:47 -0700103}
104#else
105static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm)
106{ }
107#endif /* CONFIG_SECURITY_NETWORK */
108
Linus Torvalds1da177e2005-04-16 15:20:36 -0700109static __inline__ void scm_recv(struct socket *sock, struct msghdr *msg,
110 struct scm_cookie *scm, int flags)
111{
Eric Dumazetfd2c3ef2009-11-03 03:26:03 +0000112 if (!msg->msg_control) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700113 if (test_bit(SOCK_PASSCRED, &sock->flags) || scm->fp)
114 msg->msg_flags |= MSG_CTRUNC;
David S. Millerf78a5fd2011-09-16 19:34:00 -0400115 scm_destroy(scm);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700116 return;
117 }
118
Eric W. Biedermandbe9a412012-09-06 18:20:01 +0000119 if (test_bit(SOCK_PASSCRED, &sock->flags)) {
120 struct user_namespace *current_ns = current_user_ns();
121 struct ucred ucreds = {
122 .pid = scm->creds.pid,
123 .uid = from_kuid_munged(current_ns, scm->creds.uid),
124 .gid = from_kgid_munged(current_ns, scm->creds.gid),
125 };
126 put_cmsg(msg, SOL_SOCKET, SCM_CREDENTIALS, sizeof(ucreds), &ucreds);
127 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700128
David S. Millerf78a5fd2011-09-16 19:34:00 -0400129 scm_destroy_cred(scm);
130
Catherine Zhang877ce7c2006-06-29 12:27:47 -0700131 scm_passec(sock, msg, scm);
132
Linus Torvalds1da177e2005-04-16 15:20:36 -0700133 if (!scm->fp)
134 return;
135
136 scm_detach_fds(msg, scm);
137}
138
139
140#endif /* __LINUX_NET_SCM_H */
141